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1. Shortly after Hitler 8 s assumption of power Hermann Goering was 
sold the idea of setting up a new, comprehensive intelligence agency 
which would supply the Party and in particular Goering himself with all 
possible secret information* The new agency bore the innocent name 
"Das Forschungsamt des Re ichsluf tminis te riums " (The Research Office of 
the German Air Ministry) but was really Gearing’s private affair* He 
secured ample funds, the FA, as it was called, soon had new buildings 
and the most up*»to°date equipment* Some of the leading spirits had 
been discontented members of the Cipher Bureau of the Armed Forces, a 
few were capable cryptanalysts. It covered all fields of communication, 
mail, telephone, cable, broadcasts and radio; it spied on all other 
branches of the government and the results of its work were used to induce 
Hitler to purge a number of men who were obnoxious to Goering* Little 
was known in the West about the existence of this agency until TIC CM 
Teams began to pick up information after the surrender* Even then most 

of the information came from men in other agencies, some of whom were 
doubtless prejudiced against the FA* Estimates of the value of the FA 
were conflicting* 

2. Eventually an opportunity came to get information from some 
of the members of the Forschungsamt itself* Those who originally 
agreed to write accounts of the organization and its work later 
declined to do so, but finally a rr augments were made for a group of three 
men to do some homework* A list of questions was submitted* 

3. Dr. Krosger, the leader of this small group, has chosen to 
answer soma of the questions separately but to combine the answers to 
others into a treatise "SYSTEMATIC, ANALYSE UND SICHERHEIT DER 
GEHEIMSCHRIFTEN ,, . The present paper is offered to show the scope of 
the project and a sample section (III Ala) was submitted to give m 
idea of the treatment* This section has been translated and is being 
issued simultaneously as DF 240—B. Answers to the other ouestions will 
be translated and issued under the general short title DF 241« It is 
hoped that the two series, DF 240 and DF 241, will add materially to our 
knowledge of the Forschungsamt and its work* 

4* Dr. Kroeger is willing to be guided in his work by comments and 
suggestions, provided they reach him in time* Any comments should, there- 
fore, be forwarded to AFSA~14 promptly. 


April 1951 
Translated* R.W.P. 
Distribution: Normal 


35 copies 
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TREATISE 


CHARACTERISTICS, ANALYSIS AND SECURITY OF CRYPTOGRAPHIC SYSTEMS 


Introduction 

lo GRUNDVERFAHREN 
General systems 

A e Ersatzverfahren 

Substitution Systems 

1) Einfacher Buchstabencfisar 
Simple monoalphabetic substitution 

a) alphabetisch 

with standard alphabets 

b) systematisch 

with systematically mixed alphabets 

c) reziprok 

with reciprocal alphabets 

d) unsystematisch 

with random alphabet 

2) Einfacher Zahlenc&sar 
Simple numerical substitution 

3) Mehrfach belegter Zahlene&sar elnschliesslich 2 Z Cr 100 
Diname substitution with variants, including all 100 din on© s (?) 

4) Deutscher Paarc&sar 

German digraphic substitution 

5) Engliecher Paarcftsar 
Playfair cipher 

6) Wechselstelliger ZahlencAsar 
Monome-dinome substitution 

7) Spaltenc&sar 

Periodic polyalphabetie substitution 

a) Tritheim 

Tritheim [?iginere table] 

b) unsystematisch 

random unrelated sequences 

c) Komtaunistenverfahron 
Communist systems 

d) Buchverschltisselung 
Encipherment by means of a key book. 
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8) Springcfisar 

interrupted periodic polyalphabetic substitution 

9) Systematik bei Spalten- und Springcfisaren 
Systematic features of poly alphabetic substitutions 

with regular or interrupted period (?) 

a) kurzer Schieber 
short slide 

b) langer Schieber 
long slide . 

10) Spaltencdsar mit Viahlverzifferung 

Periodic substitution vdth optional keyword (?) 

11) Codes 
Codes 

a) alphabetische und systematische codes 
one part and caption codes 

b) unsystematische und wechselstellige codes 

two part codes and codes with groups of vary in; length 

c) Mehrfachbelegung von codes 
Use of variants 

B. Yersatzverfahren 

Transposition systems 

1) Umstellung 

Shifting of group elements (?) 

2) Drehraster, Schieberaster 
Revolving grille, sliding grille 

3) Wurfel 

Matrix (box) transposition 

a) einfacher TOrfel 

simple (rectangular) matrix 

b) besondere TTOrfelformen 
special matrix forms 

c) Schlttsselw&rter und Schlttsselzahlen 
Key words and numerical keys 

II. KOMBINIERTE BEST. UBERSCKIXJSSELTE VERFAKREN 
Combined or Superenciphered Systems 

r 

A. Ubers chlus s elungen 
Superencipherments 

1) Tauschtafelttberschltisselung 

reencipherment by substitution table 

a) einsteilige Tauschtafeln 

one place substitution tables 

b) mehrstellige Tauschtafeln 
multi-place substitution tables 

c) Perioden 

periods . 
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tfbersehlttsselungszahlen im Additionsverfahren 
Supsrencipherment by additive 

a) relative Codes 
relative codes 

b) besehrflnkte Uberschltlsse lungs zahlen 
finite additive sequence 

c) (f Z[j» ilberschltisselungszahlenj” Tafeln 
Additive tables 

d) Z - unendlich 
Additive sequence - non-repeating 

e) russische U Z aus S chltis selzahlen entvdckelt 
Russian additive derived from key numbers 

ilberschltisselungszahlen im Tauschtafelverfahren 
Superencipherment numbers in substitution table- systems 

B„ Kcanbinierte Verfahren 
Combined systems 

1) DoppelwflrfaL 
Double transposition 

2) Wfirfel mit Raster 
Transposition matrix vdth grille 

3) Cflsar und Codes mit Ums tel lung 

Substitution and codes with shifting of elements (?) 

4) Cflsar and Codes mit WQrfel 
Substitution and codes with transposition 

5) Tausehtaf el mit Umstellung 
Substitution table with shifting (?) 

6) Uberschlue selungszahl mit Umstellung 
Reencipherment number vdth shifting (?) 

IIIo CHIFFRIERMASCHDJEN 
Cipher Machines 

A« Deutsche Typen 
German types 

1) Enigoa-Uaschinen 
Enigma machines 

a) Type K 

ff It 

b) Type G 

u m 

c) Heeres-Enigma 
Amoy Enigma 
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2) Sieoens-Geheijnfemschreibmaschinen 
Siemens Secret Teleprinter 

a) SMF 52 Typ AB 

b) SMF 52 Typ C 

c) SMF 52 Typ D und E 

3) Heereezusatzgerfit 

Army supplemental (cipher) device 

Bo Andere Typen 
Other types 

1) Japan is cha Maschine 
Japanese Machine 

2) Hagelin=Maschinen 
Hagelin machines 

3) Russiche Mshrkabel-Funkmas chinen 
Russian multi-channel radio equipment 

4) Englische Maschine 
English machine 

Co Kenngrupparibedeutung bei Maschinenverfahren 

Significance of indicator groups vith machine systems 

UTo ALLGEMEINE BEMERKUNGEN UNO ERoXnZUNGEN zur 
General and suplementary remarks on 

A 0 Systematik der Geheimschriffen 

Systematic character of cryptographic systems 

B« Analyse von Geheimschriften 

Analysis of cryptographic systems 

Co Sieher&eit von Gehelmschrfiten gegen unbefugte 
Er.tzifferung von dritter Seite* 

Security of cryptographic systems against unauthorized 
decryption by third parties 0 
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CHARACTERISTICS, ANALYSIS AND SECURITY OF CRYPTOGRAPHIC SYSTEMS 

Analysis of the Enigma Cipher Machine Type K 
(III, Ala) 


lo Attached is an Armed Forces Security Agency translation of 
a sample section of the treatise being written by Dr. Kroeger, formerly 
with Goering 3 3 cryptologic agency the "Forschungsamt", The German title 
of the treatise as a whole is "SYSTEMATIC , ANALYSE UND SICHERHEIT HER 
GEHEIMSCHR IFTEN " , the title of this section is "ANALYSE DER CHIFFRIER- 
MASCH3HE ENIGMA TIP K» e 

2. The section on the Enigma Type K was submitted as a sample, 
along with the proposed Table of Contents (see DF 240 A), with the 
suggestion that any comments be forwarded to the author in time for 
him to take them into account while composing the rest of the work 0 
Comments should be sent promptly to AFSA-14° 

3* At the same time answers were received to certain questions 
submitted to Dr. Kroeger and his associates: these are being issued 
as DF 241 A« Answers to other questions and additional installments 
of the major work are expected and will be issued as receivedo The 
two series, DF 240 and DF 241 will, it is hoped, add materially to 
our knowledge of the Forschungsamt and its worlc 0 


Translated: R.W.Po 3$ copies 

Edited: R.E.C. 

April 1951 23 pages 

Distribution: Normal 
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UHftlUGTisRISriKS, ANALYSIS AND SECURITY OF CRiTTOGSAFHIC iXEVDHSl > 

SYSTEMS 

Analysis of the Enigma Cipher Machine Type K 
(III. A 1 a) 


a. Analysis of the Enigma Cipher Machine Type K . 

Part 1: Development of the regularities of the cipher text which 
are due to t he construction of the type K Enigaa 0 
Part 2: Possibilities of solution based on these regularities. 
Possibility A 
Possibility B 

Part 3: Estimate of the security of the Enigma Cipher Machine 
Appendix III A 1 a, sheets 1 to 8. 

Part 1 

The construction and functioning of the Enigma Type K is assumed to be 
known. It is shown schematically as a paper device in Appendix III Ala, 
sheet 1: by the aid of this paper device any cipher text can be produced in 
the Same manner as vdth the machine itself, assuming the wheel wirings agree. 

In Appendix III Ala, sheet 1 $ the column of letters at the right 

corresponds to a fixed disk in the original machine which lies to the right 

of the right hand movable wheel. In the machine this disk i3 connected both 

with the key board and with the illuminated letters in the sequence of the 

letters in this column, which therefore is designated hereafter as the entry 
■a* 

wheel alphabet « 

* Editor® s note: It has been felt advisable to include, in addition to the 

original analogue which has been constructed in a manner which 
may be unfamiliar to some, another analogue which is the crypto™ 
graphic equivalent of the original and has been made in accord 
with those used In our own courses of instruction; this appears 
as sheet la, and follows sheet 1. This analogue may be used 
throughout in place of the original. 

** Editor 9 8 note: In our own terminology, the "endplata sequence." 
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Tho paper strips I, II and in represent the wheels themselves which 

may stand in the positions A, B, and C corresponding to the wheel order 

selected* The outer sequences of numbers running from 1 to 26 at the right 

and left of each strip correspond to the 26 points of entry and exit on 

each wheel* Vie have designated as Point 1 that point on each wheel at 

which the letter ring has been set* The inner sequences of numbers show 

the wiring within the wheels and the numbers of the inner sequences indicate 

the point on the opposite face of the wheel with which the particular point 

* 

of entry or exit is connected. The two columns of numbers standing on 
the left side of the paper device correspond to the reversing wheel or 
mirror wheel in a specific position and with a given wiring. The sequences 
of letters in. the middle of the paper strips represent tho setting ring3 
on the wheel in a specific position. The lines between the letters m and 
n on Wheel I, f and g on Wheel II, y and z on Wheel III are intended to 
indicate the notches on the setting rings into which the transport lever ** 
(indicated in the paper device by an arrow) engages at the appropriate 
position and thus causes the stepping of the middle wheel or of the left 
wheel. The hatched squares shown in the bottom row (on a level with q 
of the entry alphabet) are intended to represent the windows in which the 
window setting of the wheel is visible. 

With this paper device, with the arbitrarily assigned wheel order 

I III H, the Inner ring setting v for Wheel I, 1 for Wheel II and h for 

Wheel III and the external window setting n c f for the three wheels, all 

the cipher values for the plain text letters of the sequence of the entry 

wheel have been developed in 26 successive positions of the right wheel 

and are shown in Appendix III A 1 a, sheet 2. In so doing the first 21 

of the resulting substitution alphabets have been so separated from the 

^ Editor 8 s note: It is not "essentia! that both ''outer''' and "inner" " ~ 

sequences should appear on the strips, as in the 
original analogue. The strips used on sheet la 
contain only one sequence on each side, yet are the 
equivalents of the original ones. 

** Editor's note: In our own terminology, the "trip lug." 
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last five by a vertical stroke, because at this point the middle wheel 
made a step. Hence at this point the wheel complex *™ reversing wheel, 

V»heel I and ITheel III, which really forms a reversing mirror - is changed. 

The following presentation of the regularities of the cipher text 
of the Enigma Cipher Machine Type K rests upon the basic idea that the 
reversing wheel, the left wheel and the middle wheel form a constant 
during th9 encipherment of 26 letters which lie between the steps of the 
middle wheel. Consequently we have wider lying the encipherment of 26 
successive cipher letters in each case merely: 

1, The wheal wiring of the right wheel and 

2. The reversing mirror formed by tlie reversing wheel, the 
left wheel and the middle wheel. 

Our task in the following is therefore to develop the cipher texts 
of Appendix III Ala, sheet 2, in such fashion that the regularities 
inherent in the wiring of the right wheel and in the reversing mirror 
can be recognized. 

For this purpose the substitution alphabets of Appendix III Ala, 
sheet 2, have bsen converted in Appendix III Ala, sheet 3s into numerical 
values in such fashion that the letters q to a have been transformed 
into the entrance wheel values 21 to 20 which are valid with the initial 
position f for tho right wheel. 

In Appendix III A 1 a, sheet 4, numbers have been added to the 

numerical values in Appendix III Ala, sheet 3, as follows: 1 to the 

values of the second substitution alphabet (i.e, to the second vertical 

column of numbers), 2 to those of alphabet 3a 3 to those of alphabet 4 etc,, 

* 

whereby all the cipher letters of Appendix 3 A 1 a, sheet 1 , have been 

converted into the entry values of this wheel which are valid in the wheel 

position of the right wheel at the moment. Through this transformat ion 

we have succeeded in bringing the substitution alphabet values of Appendix 

III Ala, sheet 1 , to a uniform denominator which is independent of the 

movement of the right wheel. 

* Editor 1 s note: Should read "sheet 2", 

Editor's note: . Should read "sheet 3"« 
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In Appendix III Ala, sheet 4, the numerical substitution alphabet 
values standing in the diagonals running down from left to right have been 
formed in each case by the same wheel wiring leading from the or/ try wheel 
alphabet to the reversing mirror 0 

In the next Appendix III A 1 a, sheet 5„ these diagonals have been 
taken out and arranged horizontally, A closer study shows that these 
sequences are similar to one another in their structure, as a comparison 
of diagonal 7 with diagonal 6 reveals. Here the structurally similar 
make-up of each series with any other series appears with the displacement 
of one value to the right in each case. The values found in each of these 
diagonal sequences have the same wheel wiring on their path from the entry 
alphabet to the reversing mirror which lies between the middle and right 
wheel and hence use in succession all inirror wirings cf the reversing 
mirror corresponding to the stepping of the right wheel. The structural 
similarity of the diagonal series with one another is therefore only a 
reflection of the reversing mirror which is valid for the right wheel. 

To further clarify this fact we have presented in Appendix III ala, 
sheet 6s 

lo The reversing mirror valid for the right wheel with the window 
setting n o f, as it is formed by the wheel complex: reversing 
wheel, Wheel I and TOieel III*; 

2. The same reversing inirror expressed in difference values between 
the contact points; 

3* Two different diagonal sequences from Appendix III Ala, sheet 3, 

# 4 * 

at an elevation corresponding to the reversing mirror. 

Editor's note: In the illustration cited, the numblr "1" is usedt'o"' 
designate the contact point which is located directly 
"beside" the window at the rlght~hand side of wheel III; 
number "2" designates the point just above "1", "3% the 
point above "2", etc. 

** Editor® e note: That is, the sequences have been aligned in such a manner 

that corresponding points of the isomorphic pattern of 
each are adjacent or on the same horizontal line. 
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The structural similarity of the diagonal sequences to the reversing 
mirror expressed in difference values thus become quite evident. 

Now if all diagonal series are arranged according to their structural 
similarity to "the reversing mirror, as has been done in Appendix HI Ala, 
sheet 7, and in Appendix III Ala, Sheet 8, (in this case xvith a displace- 
ment degree 1), then it is clear from Appendix III A 1 a. Sheet 8, that 
with this arrangemsnfc not only the vortical columns of numbers but also the 
number sequences of the diagonal series represent nothing other than the 
wheel wiring sequence of the right wheel, as it is found in the left inner 

$f- 

column of v&ieel II in Appendix III Ala, sheet 1 , 

Thus it is proven that by converting the plain text and cipher text 
letters into the corresponding numerical values of the entrance wheel 
series the wheel raring of the Enigma Type K can be reconstructed. 

Part 2 

On the basis of the regularities shown in Part 1 we find the following 
possibilities of solution for the Enigma Cipher Machine Type K: 

Possibility A . 7/e assume the knowledge of three successive substitution 
alphabets, which have been obtained by solving several messages in the same 
key or in some other way. 

These alphabets are converted into numerical values in the manner 
described in Paid; 1 and are entered on strips corresponding to the rows 
of Appendix III Ala, sheet 8. As an example we shall use the first 
three alphabets after the stepping of the middle wheel from the example 
in Part 1, i 0 e. alphabets 16 to 18 of Appendix 111 Ala, sheet 4, as 
they appear in Appendix III Ala, sheet 8; then we should have the 


following strips : 

(£> 20 13 24 


15 4 5 

< 19 ; 

13 6 25 


8 9 8 


18 23 4 

C2Q) 

13 6 


9 20 14 

6 10 11 

(&} 

22 15 13 

19 1 12 

(2D 
f 22) 

7 8 22 
12 18 21 


14 25 10 

QB 

5 24 3 

< 23j 

2611 7 


4 19 20 

21 17 23 

<3 

30 12 16 

24 26 15 

5S» 

16 14 1 

17 5 19 

2 21 2 

m 

25 7 18 


23 16 9 

(3 

3 2 26 

m 

11 22 17 




■^ Editor’s note: in the analogue on sheet la, the left-hand sequence of wheel Ho 
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Starting vdth any desired strip tie other strips are associated 
[ "linked”] one after the otter to this initial strip, until from the 
conclusions drawn from the comparison it is detemined whether the 
sequence of strips or of wheel wirings chosen is correct or not. Hence 
we shall assume first that strip follows the initial strip(i$s 

fl7) 25 7 IB 

(18) 11 22 18 

The columns 7 11 and 18 22 which result signify, corresponding to the 

regularities demonstrated in Part 1, that, with an assumed wheel wiring 
* 

sequence 17 18, the sequences 7 11 and 18 22 result 0 If the strips 
corresponding to ttese wheel sequences are placed one beneath the other 
and the resulting deductions are made, we get the following: 

1. (7) 21 17 23 (IS) 11 22 17 

(ll) 18 23 4 12 18 21 

Since the new sequence 23 23 would result and this is impossible, we 
have shown that the assumed sequence 17 18 was false 0 

Now the next assumption is made, that strip ( 17 ) is followed by stripClf^ 
This yields the following: 
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1.) 

© 

25 

7 

18 








© 


13 

6 

25 




) 


2.) 

<Z> 

21 

17 

23 


£ia> 

11 

22 

17 



© 


19 

1 

12 

% 


4 

19 

2D 

3.) 

<§> 

25 

11 

7 


C%) 

12 

18 

23. 



0) 


20 

13 

24 



6 

10 

11 

4.) 

© 

18 

23 

4 


<§> 

7 

8 

22 



© 


1 

3 

6 



15 

4 

5 

5.) 


6 

10 

11 


© 

2 

21 

2 



6) 


9 

20 

14 

(jj) 


10 

12 

16 

6J 

© 

15 

4 

5 


<D 

8 

9 

8 



© 


3 

2 

26 



22 

15 

13 

7.) 

vl) W 

25 

10 


<3> 

3 

2 

26 



6': 

VS/ 


8 

9 

8 

i,22) 


12 

18 

21 

8.) 

sl- 

<25j 

17 

5 

19 


© 

23 

16 

9 



' ® 


2 

21 

2 

© 


11 

22 

17 

9.) 

© 

13 

6 

25 


© 

24 

26 

15 



«§> 


7 

6 

22 

© 


18 

23 

4 

10.) 

© 

4 

19 

20 


© 

10 

12 

16 



(5) 


21 

17 

23 

<§> 


26 

11 

7 

11.) 

© 

1 

3 

6 


(12) 

22 

15 

13 



<a> 


25 

7 

18 

(26) 

■<^9 9P 


23 

16 

9 

12.) 

© 

9 

20 

14 



19 

1 

12 



<39 


17 

5 

19 

@ 


24 

26 

15 

13.) 

© 

5 

24 

3 


© 

20 

13 

24 

# 


© 


34 

25 

10 

<a> 


16 

14 

1 

14.) 

% * 

14 

1 








14) 

* T r 


5 

24 

3 
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From these fragments of the sequences we get the entire wiring of the 
right wheel as follows: 

17 19 21 10 9 22 k 3 25 8 15 23 1 2k 14 5 2 12 

26 18 6 7 13 16 11 20 17, 

This example proves that a minimum of three alphabets is sufficient for 
the reconstruction of a wheel wiring, (If the reversing mirror valid for 
the alphabets in ouestion has two successive parallel wirings with the same 
interval, then a fourth alphabet is necessary in order to get a complete 
wheel sequence o Otherwise we get for the vheel wirings several fragments 
which are nob contradictory within themselves and whose proper succession 
must be tested out with the available cipher text. 

With the wheel wiring thus obtained for the right wheel we can only 
produce for the moment a wheel which will have the sane effect, since we 
do not know from the wiring sequence itself to which points of the left 
wheel face it is to be associated. Therefore we must first make an 
arbitrary assumption which yields one of the twenty~s ix possible wheels 
which have the sams effect, Vfljich of these possible wheels represents 
the original wheel can only be determined after the reconstruction of the 
remaining wheels 0 

For the reconstruction of the middle wheel it is necessary to have 
three substitution alphabets available at an interval of 26 which will then 
be used for the reconstruction of the middle wheel in the manner shown above 
for the right wheel. These three requisite alphabets at an interval of 26 
can be picked out of the available traffic rather easily. Hex's the procedure 
is to associate an assumed plain text (frequently used telegram beginnings or 
some other word 6 to 8 letters in length, the occurrence of which in the 
text can be assumed on the basis of the traffic or of contemporary events), 
to the cipher text in such fashion that for every possible position of plain 
text and cipher text with respect to one another it is possible with the 
already reconstructed wheel to produce the mirror connections which are 
yielded by the 26 possible initial positions of the wheel and the entry 
alphabet. If contradictions occur in the mirror connection that means 
that the assumed word cannot stand at the point under consideration with 
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the assumed initial wheel setting. If no contradictions result# then the 
mirror connections obtained are used to form new plain text letters to the 
right and left of the appropriate position in this cipher texb„ If these 
can be expanded to make rational text and if the expansion yields confirma- 
tion of the mirror connections already obtained, then the correctness of 
the assumption is proven,. After that it is merely a question of expanding 
the text beyond those points where the middle wheel has stepped, and on the 
basis of the connections of the new mirror thus obtained, to again expand 
the text until a plain text of some 60 to 60 letters is available which 
matches the cipher text c From this it is then possible, by producing the 
entry alphabet valid for the middle wheel, to form three alphabets at an 
interval of 26 which will make possible the reconstruction of a wheel with 
the same effect as the original middle wheel „ 

The third wheel can be constructed in like manner using a cipher text 
where the third wheel is in the middle position,. 

From the wheels thus formed, which have the same effect as the originals, 
the original wheels can be derived if the window setting of three already 
solved cipher texts is known where wheels I, II and III each appear once as 
the right wheel,. From the window setting and the step of the middle wheel 
it can be determined which of the three wheels corresponds to the original 
wheel I, H or Ilia The right wheel face ia then reduced to the original 
values by adding a number between 0 and 25o Then with the aid of the solved 
texts the left faces of the wheels are likewise brought into the original 
position by turning the wiring sequence to that position where the different 
wheels work together correctly. 

Then if the key is sent in clear or the encipherment is known, every 
telegram can be read by setting up the inner and outer key just as it is 
read in the Cipher Bureau of the reeipiento 

If only the clear window setting is known, while the inner wheel 
setting is not known but is constant for a definite period of time, then 
the solution of one telegram by means of an assumed word is sufficient to 
enable one to read at once all other telegrams of the same period,. 
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On the other hand If the inner and outer machine setting is not known, 
then for each individual message a point of attack must be worked out by 
means of an assumed plain text word, if one is to read the message. This 
work is very time consuming if it is dons by hand; however the production 
of auxiliary devices working with electric relays is entirely id. thin the 
bounds of possibility and with their aid a quick break into almost any 
telegram will! be possible. 

Possibility B . As known we assume a sort of compromised text, i.e. 
a cipher text which has been compromised because the plain text has become 
known. This compromised text, according to the position of the steps of 
the middle vheel, must have a minimum length of 52 to 65 letters. The 
substitution alphabet values obtained from the plain text and cipher text 
are converted into numerical values after the manner described in Part 1 
and are entered on strips. In contrast to the strips 3 cells wide which 
were used for the reconstruction of the wheel wiring under possibility A 
in Part 2, the strips here have a width corresponding to the length of the 
text but only sporadic alphabet values appear on them. We now proceed to 
use these strips in iraich the same manner as was described in connection with 
possibility A in Part 2, with the sole difference that far each initial 
assumption regarding the wire sequence a second, third, fourth or even a 
fifth assumption must be made, before one can decide whether the assumptions 
made were correct or not. This would work out somewhat as follows: 

If the first assumption of a wiring sequence ??J gives no clue to 
another wiring sequence resulting thsrefrom, or if a resulting new wire 
sequence leads to no conclusion regarding the correctness of the first 
assumption, then it is expanded by a second assumption of a wiring sequence 
£L) (2j 1 3/ or even \lj ; 2} ? 3/ r - 4; in other words we continue making a new 
assumption until the possibility of this assumption is eliminated by 
resulting contradictions. The process is continued until by elimination 
of impossible wire sequences the correct sequence is found in connection 
with which no contradiction appears. 
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If the original vjindow settings for the compromised text used are 
not known, this task is rendered more difficult by the fact that you 
cannot guess at what points in the text the middle wheel has moved., 

Hence it is necessary to assume a wheel stepping with the interval 26 
successively at all possible positions, since alphabet values standing 
one beneath the other on two strips only lead to correct deductions 
regarding other wheel sequences when they have arisen with the same 
setting of the middle wheel « 

To give an idea of the extent of this labor, it may be stated that 
the reconstruction of the first wheel in this manner can be performed in 
from 1 to 6 weeks with 5 to 6 workers, just depending on whether one hit3 
on the original sequence early or late in the guessing process.. 

The reconstruction of the other two wheels can then be accomplished 
relatively quickly in the manner described under possibility A in Part 2.» 

Part 3 

From the standpoint of security it is necessary to require of each 

system that it remain incapable of solution by an unauthorized person even 

though the system as such is known, in our present case when the machine 

and the wheel wirings must be assumed to be known.. The Enigma machine 

Type K by no means satisfies any such security demand, as is obvious from 

the proceeding parts, since a single correctly guessed word of text can 

yield the solution of the messa ;e« The handling of the keys, when correct, 

can at most make it necessary to solve each message separately, but can never 

make the current reading of telegrams impossible „ If special auxiliary 

machines aro employed in decipherment it is not even possible to cause any 

essential delay in the unauthorized decryption Even a frequent change of 

the wheel wiring will not satisfy the security requirements. That we are 

not talking here of excessive security demands will be clear from the 

supplementary remar Its in Part 4 Section C of the present report,, 

The principle of enciphering the wheels, which is good in and of 

itself, could only produce results which would satisfy the security 

v* 



reouireraents if the Enigma we: re entirely reconstructed, Basic requirements 
for such a reconstruction would be: 

1, The regular stepping of the wheels must become ouite irregular and 
appropriate means must be provided for making this stepping subject 
to setting, 

2. The mirror connections must be easily varied by appropriate devices, 

3. The entry alphabet must be subject to change by plug connections 
between the letter keys and tho entry wheel, 

4, The reciprocal character of the alphabets formed by the machine 
must be done away with. 

In any case there is no possibility of using the Enigma type K in 
its present state in a manner v.hich will satisfy security demands. 

Of course as a otop~gap measure it would be possible to encipher type 
K messages again with the same itsachine or the plain text might first be 
enciphered by another system and then reenciphered with the Enigaa, But 
such a make-shift solution would not be satisfactory because encipherment 
and decipherment become too time consuming and simple hand systems might 
afford greater security and quicker encipherment and decipherment. 
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Introductory Eesarks. 

Foe the purpose of this study a co^samicatian will be regarded ae composed 
in & cryptographic system when * . . 

1. Ite character gw a cogaamicatioa la plainly to be recognised, 

2. The ccaiaamicatian consists of ordinary letters or new characters vhich 

have been agreed upon in advance, but . * 

3* 2he sequence of these characters is not Intended te yield meaningful 
'words or sentences for. a third party. 

The purpose of tee cryptogram is then that it ah^ii be readable for the sender 

• . • ‘ ’ • ' • Vi'. 

and receiver but sot for third parties ~ particularly during tranasftsaiaa. 

Excluded freon tee study ere all methods of secret transmission of ccmami- 
cations where tea cassamication is not recognisable as ouch by third parties, 
for instance where invisible inks are used, or 'Where there is no written fixation, 
for instance in case of speech scrambling. For tee essence of tee cryptographic 
system it makes no difference which language and which characters are employed 
or in Which way the cogamnicatlcaas are sent. The question of how an encrypted 
cammanication is sent plays a role only when the security of cryptogmas against 
unauthorized reading is being studied. 
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PART I 

BASIC SYSTEMS 

„* ' * 

vflien the secret text which Is to be transmitted can be developed from 
the underlying plain text in a single procedure, then such systems are called 
basic systems ( Grundverfahren) . 

If> can the other hand, the secret text has teen developed from the plain 

text by two more more procedures;!; one after the other^we then speak of combined 

‘ * «* 

* * . 

or superenciphered systems ( Kombinicrte cdar Qberschlflsselte Ve rfahren ) ? 

Prom the standpoint of the study of characteristics it makes no difference 
whether the cryptogram is developed from the plain text manually or by the aid 
of a particular cipher machine, i«e, whether a hand system or a machine system 
is involved* If in the course of this study cipher machines are treated in a 
special section, this is not due to characteristics but simply to practical 
considerations, in particular to their analysis and the multiplicity of 
technical possibilities which exist. 

Section A, , 

Substitution Systems < 

( Ersatgverfahren ) 

According to the net hoi employed to convert the plain text into a cipher 
text, cryptographic systems are divided into substitution and transposition 
systems, - 

A substitution system is involved when the individual elements of the plain 
text are replaced by other elements of the cipher text but remain in their 
natural sequence. On the other hand with a transposition system the individual 
elements of the plain language are preserved but are taken out of their natural 
sequence and transposed with respect to one another according to definite rules. 


1, Simple substitution, ( Einfacher CMsar) - 

The simplest of all substitution systems and possibly the oldest of all 

' 7 
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cryptographic procedures, where each element of the plain language - be it 
letter, number, punctuation mark or a combination of these - is replaced in 
its natural sequence by a cipher element, is called a Cttsar (simple substitu- 
tian)<> This name is due to the fact that it was assumed => whether ri$itly or 
wrongly we need not determine ~ that in ancient times Caesar was the first person 
to make use of this cryptographic system 0 

According to whether letters or digits are used as cipher elements we speak 
of letter substitution or digit substitution. The use of any other symbols in 
place of letters or digits may be disregarded because they do not cause any 
difference in character and such attempts are v/ithout any practical significance 
and are only proposed by laymen. 

The letter system is to be preferred to the digit system when it is a 
question of keeping the cipher text as short as possible, for instance to keep 
down telegraph charges, because compared xvith the use of digits the use of 
letters affords 

2-1/2 times as many possibilities when taken one at a time 

6-1/2 n *» *» » M U fc wo M It M 

17-1/2 « n h n U « three •' " " 

more than 45 " n " " " « four » " » . 

On the other hand, digits have an advantage over letters in that they are 

* *V' 

easier, quicker and surer to handle, particularly in the case of all super- 
encipherments. For this reason letters predominate in machine systems, because 
here the work is done by the machine, whereas in the case of hand systems 
preference' may frequently be given to digits. 

In the following examples of the structure of substitution alphabets? 


Plain sequences 


a b c d e f g h i j klmnopqr stu vwxyz 


Cipher sequence Is. xyzabedefghijklmnopqrstuvw 


Cipher sequence 2s 
Cipher sequence 3 5 


zyxwvut srqponmlkjih gfedcba 
goyjvnap silks fbhwxmuteqre i 
Cipher sequence 4s ejotydinsxchmrwbglavafkpuz 
Cipher sequence 5s m q f op ckrl j zas g t n b u d v w e h y i x 
• 8 
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cipher sequence 1 represents a standard alphabet (with a displacement of 3) • 
( alphabetischen C&sar im Versehiebung3grad 3) I cipher sequence 2 a reversed 
and reciprocal alphabet ( alphabetisch rttcklaufigen und reziproken Cfl sar ) , 
cipher sequence 3 a reciprocal alphabet ( reziproken Cflsar ) , cipher sequence 4 
a systematically mixed alphabet (alphabet at an interval of 5) ( systematischen 
Cflsar ( Alphabet im Abstand 5 ent halten ) ) „ and cipher sequence 5 represents a 
random alphabet ( ungystematlschen Casar ). Digit substitutions may be developed 
in corresponding fashion whereby’ the alphabetic arrangement is replaced by an 
arithmetic arrangement <> In addition, v&th systematic' digit substitutions it is 
possible to derive the sequences from the digit square using a key word 
( Schlflsselwort ) or a route ( Duktue ). as is Shorn in the Appendices© 

At this point it may be remarked that it will be well, while reading 
the following pages, to take out an appendix as mentioned and to keep it 
sproad besides the text until the following appendix is mentioned,,* Constant 
comparison of the text and the explanatory example' should greatly facilitate 
comprehension© 

In Appendix IA la we have on sheet la plain text converted into cipher 
text with the aid’ of the substitution alphabet (normal) shown at the top of sheet 2 0 
In order to determine the security of such a system against unauthorized 
decipherment > ioe 0 against d ecipherrient by third parties, it is necessary to' 
subject the cipher text to a somewhat detailed study. For this purpose the 
cipher text of this simple letter substitution has been subjected to a so-called 
biliteral count ( einatellirre Kettenstatistlk. literally, 1- place chain count) 
in the following manner: 

At. the left margin of sheet 2 of the ^appendix the possible cipher elements 
from a to z have been entered in alphabetic sequence one beneath the other on 
26 lines and in each case represent the first member of a link of this chain 4 
count which is undertaken as follow So Of the cipher text beginning hgekxtc©©© 
etc., the first two elements hg are taken first, then the elements in second 
and third position go, then the elements in third and fourth position ek etc 0 

* Note: These have been bound in at the end of each section© 
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and counted so that in rro h (first link) a >gp (second member of a link) is 
entered, in row g an in row e aT^etc. with the appreciate voq index from 
1 to 7. Die entry in row h signifies therefore that the sequence of cipher 
letters hg appears in the first row of the cipher test. The entry x-jx^ tn row 
k signifies that the cipher digraph kx appears twice in the first line of the 
cipher teat. In the s ease manner as this repeated digraph longer repeats in the 
cipher text are repealed hy the. count. These repetitions in the cipher texts are 
called parallel passages and are regularly marked in the same maimer, using 
colored pencil. Moreover an index .number beneath this marking shows in which 
lines of the cipher text the other parallel passages are to be sought. 

In this connection it is generally well r to consider as parallel passages and 
feo mask as such in the cipher text only repetitions with a definite minimum length. 
In this way we make sure that only those repetitions in the cipher text are con« 
sidered as parallel passages to which a repetition in the plain text corresponds. 
This minimum length will have to be determined variously, depending on the 
cryptographic system and on the amount of material to be studied. In the present 
system, the simple letter substitution, even the shortest parallel passages, 
namely digraphs, may be taken into account because in this system only genuine 
parallel passages occur there a repetition in the plain text does correspond to 
the repetition in the cipher text. The chain count carried out in the manner 
described has been evaluated on sheet 2 of the appendix by adding up the number 
of entries in each row, l.e. for each cipher letter, separately „ This znsriber 
shows how frequently the particular letter has appeared in the cipher texts, 
while the entries on the line itself indicate the other cipher elements. in 
connection with which the one under study occurs. Thus it may be important for 
interpretation to know-which cipher elements occur repeatedly paired with them- 
selves, because in a. text in the German language these might suggest the digraphs 
B 0 , 11, m, etc, or -which cipher elements enter into combinations with definite 
other elements primarily, whether these, second elements are rare or frequent, 
and many other things. 
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In the tabulation ut tile bottom, of sheet 2 the cipher elements are arranged 
according to their frequency In the cipher teat, in ■which connection the number 
of different cipher elements is also shown. Finally on sheet 3 the parallel 
passages are listed ■with on indication of their position in the test by row and 
column, their length and their intervals from one another. Intervals and lengths 

J . ! # 

of parallel passages are always calculated, according to individual elements. 
Intervals are counted from the beginning of the first parallel passage to the 
beginning of the second parallel passage.. 

From this we get for the present simple substitution the following analysis: 

1. The number of different cipher elements found in a test of 200 elements 
is 20. 

2. The cipher elements show plain-text frequency. 

3. The parallel passages oecur with plain-text frequency. 1 

4. The length of the parallel passages is not regular. 

5. The interval between parallel passages is not- regular. 

This result corresponds with that which would result from a study of the appro- 

* 0 

priate plain text. Nothing else was to be expected because by a simple substi- 
tution a particular plain element is always replaced by another particular cipher 
element, so that the over-all picture, taken as such, has not changed, aside 
from the fact that the sequences of letters no longer make sense . 

The solution of such a cipher text by an unauthorized person, i.e. without 
knowledge of the substitution on which the encipherment is based, is correspon- 
dingly simple „ It requires nothing more then a little talent for putting two 
and two together, plus a knowledge of the frequencies of the several plain 
elements end of the frequent digraphs and trigrsphs of the language, a know- 
ledge which can be obtained by a count of a suitable plain text of adequate 
length. This table of frequencies, which tunas out slightly different for each 
language corresponding to Its peculiarities, is assumed to be known, as is the 
arrangement of the plain letters according to their frequency, which in German 
runs e n i r stu&sb etc. 

11 
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■ m begin by replacing by on e the most frequent cipher letter k in oar 
test, *jhich on the basis of its outstanding frequency cm immediately be- inter- 
preted as e'/ywe have left as equivalent for plain n the cipher elements txD2j and 
possibly y on the basis of their frequency. If we first try the assumption that 
cipher t i© equal to plain n, because . 

1. t is the second most frequent cipher element, and 

2. Both the cipher digraph kfc and the cipher digraph tk ( plain en and ne) are 
frequent, then w© get in line 2, columns 11 to 17, of the appendix the following 
picture: 

Interpretation: . n . e n e n v 

• Cipher test? © t J k t k t , » . \ 

which automatically leads us fill in "in denea". . 

IMs interpretation gains in plausibility through the fact that this passage 
would correspond to the parallel passage "otjkt", which would read "in den" and 
. the parallel passage "Jkt” which would correspond to the article "den", of which 
the former occurs once more and the latter occurs four more times In the cipher 
teat. Therefore, if on the basis of this passage we interpret cipher o. 
plain i and cipher j s plain d, which is not unlikely in view of the frequencies 
17 land lk respectively, then upon entering these interpretations we find no con- 
tradictions, for instance the text in line 4 column 13 following, shows: 
Interpretation: e dsn . die e i en sde odd el 


Cipher test: 


ck^kty^ vjokakhxomktnatjkxzatjj^o 
e due en e denindatt 



•Elia possibility^ taken with the test above, yields for the parallel passage 

© den the interpretation warden . Then the passage nder nddrei leads 
. ckxjkt ckajkt natjkxzstj j mzo 
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u© to guess ^uMertunddrei” , so that cipher a 3 plain u, cipher z s plain t 
and cipher nc plain h. The rest of the interpretation follows of necessity. 
Moreover the interpretations thus far made:* 

Cipher sequence; ebcdfifghij&lffinppqrstuvwsyz^ 

Plain sequences u v de i n r t 
when scrutinized closely reveal that the plain sequence is alphabetic so that 
the remaining interpretation© can he supplied without further ado. 

The example given in the next appendix I A l b styows a substitution charac- 
terized by an alphabet which runs backward in the cipher sequence and by the 
fact that the individual values are reciprocal , t.e.,' if plain e ? cipher v, then 
conversely plain v a cipher e. The analysis shows the same characteristics as 
the example in the preceding appendix; however the tabulation of the cipher ele- 

j • . 

meats according t® their frequency oh sheet 2 at the .bottom shows that with re- 
latively short texts - although the present text has 119 elements « marked de- 
viations frees the average frequency say occur. Thus in this example the rela- 
tive order of frequency of e and n is the reverse of the normal; letters 
like Ida are here' more frequent than 1 r s t . nevertheless the interpretation 
of the cipher text is not rendered much more difficult* if the parallel passages 

i ‘ . ; 

and digraphic frequencies are given due consideration; The cipher digraph xs, 
which occurs five times, suggests, if we consider the fact that x does not be- 
gin any other digraphic combination, the interpretation ch, assuming that the 
underlying i g^iago is Gersen. Interpretation is greatly facilitated as soon as 
the reciprocal character of the substitution is recognised. 

The test enciphered in Appendix l a 1 c with a random alphabet merely con- 
firms that has been recognized thus far and shows that even a completely random 
substitution alphabet is very easy to solve. 
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A/rtsm A i-A/T/T-i ‘O'fi AAfiAfifa, 4, A ^ Ami As* 

1 t r -4 1 r~^ *- 


ipher Text 

ft ipher text 

r PUyU^t 


/ 



T 2 S ■■ 4 £ "Tf 

aL fa, e. fie. a, A / ore srfi*'e, fie- s* fi fi/s &a / fi * / *K'>\AsTS' / e. 

^ V . ^aA * »■* * *- ^ ^ " VV^ 


-t 


¥ 


S' 


fi fi j&s A ^ A' W 6, /£■ fi £■ A fir'A'sr' fi £./>v /0 fi fa'fi, A, <s e a+ e 

Itr^ A^ikAs* t 2 a. Ax, ^ At W'A'cA </>■ 

*** 1 ?■ 11 -S<& 

^ £s fH, As aTak, 'T' £,*''* ^ d'Sr' S& /C & ^ 

K* f ^fcLftJ 1 *- ^ ^ * 4 ~ri ^ 

fi rT di £s ^ jt/£,/K AV & A j£ Jlfi r / & / i/ ^ ^/K G, UrA dt £> s*vA\r4s As 

r^i^ir 

/^ A* ^ e as o A as s) £, es*i, /&■ ^r ^ ^ / ^ 

afe^S 7 1 4 1 







. finr ik~*-jhs 




I A 1 & - 1 


-// - 
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Siaple ^onoalp 

abetic Substitution — Standard Alphabet 

a,t<d,A+x**4*’ &*'+' }*•*****• *>% 2" 

^Cipher elements 




_g^ _ 


/cipher element 

rreflueficy 


A A & O' ^ j jj / ^'fc'C'0r4s'»i/, ^ A A* ^A OT 

MX fit* ft# 1 8 'll 6 C b * * * * /I /I 

/€/*! * V ids ft*, far l £ fib /t'^'O'Vfffl 


elements 


I A 1 a - 2 
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Parallel {Passages » 

4$fe*** _! 

repeats 

dos i VI on 

S C^6C 

leiLOTfL intervals 


v : 

prvcU^%/Z j tyl . s/d 

S • Z- Is l 

iS' ,/f/f/t, 

H • £ l 

4 3.3* 


/n. tfi. 

6 * 3. 3 

n., 

<. .2> • 

^S'P'J'O 

//•UT. i/zi 

S' * *T 

6 5. 

-* 3-3.** 

=. 57*- 


y/^r. i/ze. h/rf. 

(e c Z- 3 

65. /•fir. 

??-- >./0 


*!*. 6/6. 

5" . r 

//S'. 

«■ jr:^3 


<ft'. c/tf. 

// « /* 

n. 

* 8 


Wz T/# 

£ • Z-iu-Z 

St' 

- *.?•* 

//totj/dC 

6/M.sJdO: 

II 

** 

* w 


6/ f. c/z*-. 

7-= ? 

/h 

* /*• 


I A 1 a - 3 
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Plain text 
i Cipher text 


O' /i *4 

/t z I Y r l Itir/Iiirr** + * s 0 / z i> y r * b x z (k 
/n/npK & '>i / vfKAAC'£'<t'(s£>S£A'C' ^ £ 4,^4. a, ^ i> cr 

r&&\/ 

Cipher text 


JiV'fiK'tX^i'tol'rirn.h l <T±h*r2 

I i 1 # i . M <__ 


X, 




iin te> 


/ 


3 


/n. i e / £ /rX 4- ''**■ X/> £ a cr-A f- + 

\A W'A't/' CrZ'Art' LkX *’ frXZXJlX »- ZA jr* r ’ X> 

i , , 4 — 2 j » . — .* — — 

^ ^ftf * 

/V/n. 0 "T ZZtXfA o XX*.'*- X.'V'trnr a- XX * -v 

1 „ > . lfA, • ' ^ 4 X 

^ X e rr X £Cj&. a £ £■ *t,/*', sr nr ir'K-X * ? <r X <4- * r-fi 

£ (b-flr X /ft X C <r frX. 4 

^r <f r ,,/ „.„ v * 


7 


^^^fe^assages^re pea t s 


“uiDher text 

o' 

Positi 90 


Ajtipaf 4 *' 

n^/Zrr-rvry^xs 

y/r . x/z£ 

r . r 

«, • 

XX-/5 


sits. 3/^r 

/i « Zi -3 

52. • 

I X /*> 

hklsrxA^ 

«J/^ a/mt 

f * ? 

5 • 

i. 3 



y-i * 2 i-3 

75^ - 

3 . r . r 

/fjb^XAT 

//Jf.lf* 

r 4 » 

/6 * 

J •<£ 


JW . bjj^ 

J 

5// - 

?. yi 


i/js. zjn 

3 S 3 

/r e 

i 

3 . r 

I A 1 b 


" /f " 
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Shn-fle substitution - reciprocal reverse normal alphabet 


Plain n 1 nmai ^ 


Cipher element 


2 ^ />' r f p,/o**'+’£'& j ^ $ 'f 


6*0, 




11 %. > Y r U * > to* ± * r *- t l * ’ O’ 


•\, 

!r 

c 

<t 

c 

f 

1/ 

i 

/ 

JU 


b' 


r* 

L 




£lA£lL- 



\*ju r ' i * Y 


4% ty&i. 

?iA v* 

‘ VtA&K 


% 


>K K/, Z/t ‘*K 


!£<&*- 

»v VJ /Aj'VyAr Vv 

^ 5 ^s 5 T 


y 

3 

6 

? 

jr 

( 

3 

^3 

// 

y 

? 

3 

yy 

r 


#?.r ^—«w- 

•^f^pKereleiSrtra 

/ht “ / 

Frqqipncy 

*M 5 3 3 * O * * * r * 3 3 3 ^ " 

L l<Lt> *r t L* r* * 



I A 1 b -2 ... 


- £- 
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Cipher text 


Plain text 


Cipher text 


Cipher t 
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Plain te 


Plain text 


(V'jB'/t'a o" 'T ^ r /f~ / *"0 o A, jt /^/Hs &A, 

^ 'WOr^. 'Kfi a /(rfifty jt'h. i-A 1 TLftO-t/^ <i 
I ■— ^p-. >cp< * — —r * 

t <rt£ AsA^/S & *w 3 O A £L It ^ 4 ^ ^ ^ *~x£. ^tr / 

fc y. rA t ^ A /"V- & t £■ ' r ^.'>*iyO'X, / o-ft>-^jr'>r / »L'>i'> , i 2'*i.'h./c $ 

** — ; — 1 V. 


/. v. 

a £ <r 


j'/j' & & as >i /j~4C ^Asnr /s c p, A r /C/Z A 4, 

OT'SL 4 t J>* n i7>i / ftsO' A t A 'Hxrv 3L <±. <k 'TA 4, ^Xt, f 

kJL* — 4x^cX . *-^ r t- 


XXX 

vs 


o- y -t * 

/l * i y r v *■ & s 0 * i i y c t >- tip**' i y r t, > t t 


<t/U A fi <y^r ^ & /S' ft*.£s'C srL<e. / 4,S'A nr s£^ As C £ 4* 'H */ C. t (r/>-& 

v-^vwt nr^. it fi'fi ft> /fs'tn. /^/<r / K L t ^ 'n.'^ t'**- A^y>nst ^ nr-A 

I 1 i^r^A <- —J XXX pM** 7 1 

■O * ® Is ' J>. 


A 




A £ 7*^ €s >~l> ^ A/r^ ^ ^ ^ & sr~/A /6s ^ '**- <£ ^J £ 

Arbt'h ^i/y £• ^>i \ /C av 0 ^ / >nAC7yi^x ^ ^ ^ ^ 

M ' ^L kx: 


TO5T St 


<*v 


/TV- 

/ elements 


r 


I A 1 c - 1 
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(/Cipher elements 


G, jfr <. tC £ j- As * 4 ^ 'Y'/) Xss*Z 'V' / V~ <£ 


fis* / &sv~/*>v/r'psfc fj /^/c rbj'jrj'tl y/* 1 ' orX./C'jj' % <6 A 




C7 ; r 

o /j ^ 

j i b v jt 6 l ? $ *4 A * * * < > 8 * 5 t> 4 ± 3 V JT * *~ 

rV 

<5 4tA> *V^y ^r V 

r 

kt k^pi 

to, 

to* *< fit 4,09% 

*k 

V. 4 4, k. frd, & *i A^<>S *h *s ti*i -4*A/^ 

^ i ***i VL *Yi c, '•yV'V 7 *' 

**.%h <5 %a* % %^/Cekf 


'*•’< **5 / * I S, ^ ^V r Y kr 

A, 4i ae» /Vv 

A.kik i 'iyf v -r 

**i f,*x / \fit»‘»yfv 
fj ft &l0s&v%t^f* S K 

f/*s 4A,4sS- 

Vfl^l Ay^y^y 4 r 


Frequency 

A 1/ 
?✓ 
-i * 

3 ✓ 
/ * 
6 - 

// ' 
yy ✓ 
// ✓ 
— ✓ 
?- t/ 

* - 

5" ^ 
? •" 
tf - 

y ^ 

9 ✓ 
7 - 
6 ' 


/ s l v 




yjL- 


n^^-ov/o f \yc, t> Jlr t a or 4#t'h,<L''Z.2; ^ct 6+ifc>- 

0 Cipher elements , T O' / Q elements 

itA/A/U S S 2 7 * ?- +(,(,<; ¥ 3 l A 'I / /f/f 4 y 

%&&&&*. **-:** 


I A 1 c - 2 


- ^ - 


20 




In Appendix I A 2 a simple random digit substitution is introduced as 
example ® This substitution* in contrast to the one -place letter substitu- 
tion, is twb%3Lace* because only thus do we have enou^i cipher elements to 
cover the 26 plain elements,, On the other hand we thus get the possibility 
of including punctuation marks like period and comma or frequent digraphs 
like ch which when enciphered with two cipher elements greatly facilitate 
breaking into the substitution® 

Before undertaking the usual chain count, whose individual memtoi-s 
are here two-place* it is well to determine by a special count made in a 
digit table* which two-place cipher elements have been used for encipher- 
ment® In contrast to letter systems it is not always certain a priori with 
digit substitutions what the structure of the substitution alphabet may too 
Such a count has been made on sheet 1 of the Appendix by entering in the 
digit table with the coordinates from 0 to 9 a stroke for cipher 92 in that 
cell of the square which is formed; by the 9th column and 3rd row 0 

In all cases in which the- cipher elements consist of several digits or 
letters* in the present case of two digits* we may also speak of cipher 
groups or for short of groups or of letter or digit groups 0 By group we 
then understand that combination of two or more letters or digits which has 
a plain meaning of its own® 

Consequently the count just mentioned may also be termed a group 
count „ It is characteristic of the group count that each cipher group 
has a corresponding line or a corresponding cell of its own* On this 
line is entered* in contrast to the chain count* merely the place in the 
cipher text where this group has occurred® If in this group count we are 
only concerned with determining which cipher groups occur or what the 
frequency of the individual groups is* then the position index may be 
replaced by a cross or a stroke for each occurrence® In the latter case 
the group count may be called a frequency count ® 

In computing the lengths and the intervals of parallel passages we must 

22 




remember In the present example that the individual elements 0 to 9 and. not 
the dinames 00 to 99 are to be counted. As a result, when we break up the 
values for length and tofe&rval into the least factors the number 2 sill be 
a common factor. The diname substitution therefore has a regular feature to 
the length of end the interval between parallel passages. The solution of 
the cipher text itself is carried out In the same way as in the preceding 
examples. 

In respect to security the examples given in appendices I A 1 a , b, c 
and IAS axe approximately equal although obviously the security of a sub- 
stitution with a noxml alphabet or a reciprocal alphabet is less than that of 
one with a random alphabet. It is a common property of «i.i the simple sub- 
stitutions that the plain text structure is completely preserved In the cipher 
text; the result of this is that a cipher text enciphered by such a substitu- 
tion wiH a total length of 25 letters or less, that 1b less than one line of 
text, can still be deciphered so that the correctness of the Interpretations may 
be proved. Moreover much shorter texts can be solved, al tho ugh in that case it 
is not possible to prove the validity of the solution there may be two or 
more possible interpretations. This means that the simple substitution' .does 
not usually have the degree of security demanded for transmitting even a short 
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^JCipher text 

(/Cipher text 


/! 2 , 3 y r (, I g 5 0 / i S Y r £ r( M ) ^ 

dL /U /& A A /» s* ^ A C. ^ ^ ' 0 ^ it £ *+ ^iX + ^ 

pi S^^TjiUs^ 3£08-&'*l Wj/ti lb SS 0 ** hi ft /CO 


p/rf'.v yi & o £ a,'/>x, d,/, a <£to ^ 

klttcttsfi CZii&r^ «rn texts' « +2 K9^ % 


^ 1 m^. 


& 


r* Jt, #. ,iV /r/i t><i-f- ~t 4 yt- K«; * ^ t ji ,fi-£.a-e. so^/rSKS >* 

t£± )fi** n £-£ sett- -xes Jz jirtt j^sr^sr. -*r> | 

Cipher ext p____________J P 


/£> 


vCipher text 


i 

^ l -t- tfLQ) or* £ £ o /L £. a 6-/4- & *• sr*-/*- / t' r ^ £ ■*• 4-*r i 4 c Oi 

V I 7 

ft’SS'&QZfr K/1 tueft ft SZVS thrift ^srgtft.j-Wfrr^ O 

^ ®''ia >j|M^ ii" «'i 


-1 


T 77 T 


£, /—rr & l A, iJ-C zy'/i A ^ M 4> 'k- v 6 t, A-' j <i- «T /»t 4 , 

I 

j<r ft %jcWSi rtsrci rzO'bAi Ktesri* r+x rjt je r*-£ 3S^/i - ? £ £> 

-I ^ — ••£ — ^ 

*-«». , „ 149 groups 

- 5 


Count of cipher groups 

(T / i b y r 4 ^5 

<7 
/ 

4 

i 

r 

b 


#*- / 

«r 

4#- 

ml 

m 

WF 

PH! 

2£- n 

m 

-m- 

/// 


WT~ 

1/1/ 

«r 

/ 

*H- mt 

m t 

//// 

m 

/ 

Iff/ 



ff /f 


I A 2 - 1 
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Plain al amant. s 

U/J(ycJic^Zi £ k-l^ »v/r ^/t/5 /ir/rz y -iKDd) 

1 Cipner elements 

Ji %c hi %s<£tf tA KrsSi>Srt) ¥j XilMUt, iYi&tl tZ0t-Az i3 J}l{r4j-ie P4J-?- 


n 

■u 

d,1 

4 0 

y* 

* 5 

S3 

S' 5" 

t l 

'Hr 

n 

ti 

15 

et 

4S~ 


— ITnunl Q-f si 1 r. r^ s s iv e d inoraea . / 4 

— 1 + 7 r — i j — 5" • ' 


^ C ‘ mmmm 

^ 77 ^" A ^ *-.. 


/ . 
4 


^& 4 . 

TT. 

££V j» ^ 4 . vJ* 4 . Pl.fs. J^4 

VZti. ^ 6 c. £?*. < 5 ^ 4 - 

~Ph " 7Xt ~ JW ' mm 
lfH. iZk -£t 


Mlr^jjr. 

? 5 ? 


KJr. tst-. rf- 4 .. cf*. 


Me SSii ( '*<-. th 

' -VW 


5 TA .?.. ^ 4 'fc. 


• « _ hi ( 

f 3 <i • *■».</. • £_t. 

»»* 7 ?? n<’- J& a* <*/ -Dt* 

^?i»- ^/c. w^w 




ar 'tn »v<,. 

tr«. ,V. ?» < ■ ryf .'.*-v. 

•^€^ 4 .' ^^USs^S^tS. s^S^. *j ^5 l^ &. * * ■**. 

•iSV -^ 4 , ATa.^/JA. 0 ^ rtA <*c.. > 2 * J 3 r. 

25*. MU ■ ZM. - 

^y«. -*TTA ,^v. 4,^,, 

«U. <rfa. PTA -fr. . £V y 5 .< M< -^, 

S^J,. *£♦. /^J *. « 2 >^ 

<7?*. >^ 4 . 3 f^ yjA **<“ «^v< ~^ 2 . f>*£ # 


treqtiencyc 

//* ^ 
/ O' * 

// ^ 

?• * 

i ' 
5 ' 
¥ ^ 
5 ✓ 

nr ' 

/ b r 

¥ * 
6> * 
¥ r 

/A * 
9 r 

r ^ 

e ' 

A ' 
S' ^ 

G - 


JIy<J^^4r^1floe>*s (ZLZf-ykeS/ <^p~r^iH-- 

TTZtf&r 5^UPS fi A ora^r 1 oi ii'fequenfiy 1 ^ ^ 20 &rou 

u t *5.<r-}U~' ir&rt a# isti w n ^*3 *y y^>sb/Y k , 

(^CipheK groups 

K'-SL'i/fuJ- AA Jk M H tv J H H 6 r; H V 
Frequency 

^fe^qu^^nt kQ^nrj, O 


1 groups 


.. P araller pflQsapp^ — 

7^wy 


H ->s M3H to Jf H /5 
h irVj >p 

■’^ 4 ?-r^.-'iS' 


>/?. <t/s-. 

4^4 . djb . djUo 

<.!/,. V J * 


?- 

//,? * 03 3 


A *^T j 

/^ ^ J -2 -/ * 2 ^ 




Tnt.nrvs.~i _ 

- 2 - 


^3 


//? ' * 3 . /f$ 

fQ‘ ¥■ /A 
Sl\ z- 5. r 


I A 2 


O Z ■ 5A 
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3 * JJlgit substitution vith variants. (Mehrf&ch bdegter ZelilencEssr ) 

Since tiie flin o me substitution with its hundred possible cipher groups en- 
tails a possibility of additional values, it is natural that a further develop- 
ment was aimed at providing the most frequent plain elements vith more than one 
cipher group. In the example in Appendix I A 3 a the substitution contains three 
groups each for plain e and i and two groups for plain s. Hie substitution it- 
self is systematic in structure from two points of view: 

1. Hie groups used lie only on definite diagonals in the number square 
(sheet 1 of the Appendix) and 

2. The plain elements are entered first in the sequence of the letters of 
a key word (if letters occur more than once in the key word only the 
first occurrence is taken into account) and the y en m iriing letters then 
follow in alphabetic sequence. 

For purposes of analysis a 2 -place chain count, shown on sheet 2 is prepared 
after determining the substitution elements by a group count. Hie to the variants 
for frequent elements the count shows 

1. An equalised frequency without prominent peaks, 

2 . An increased number of cipher elements 25 different cipher groups 

for a text of 1^9 letters, in contrast to the previous average of about 20 . 

Hie interpretation of the cipher text on the basis of natural linguistic 
frequency would therefore run into difficulties. Consequently the count must 
be supplemented by an evaluation of the parallel passages. The super-imposition 
of parallel passages on sheet 3 of the appendix shows that there are no relative- 
ly long coutinoua parallel passages present, but only a number of relatively 
short passages following one another, and interrupted by one group which varies. 
Closer examination of the passages in position b 6 and e 2 (rov and column I n d e x 
of sheet l), namely the passages 

11 88 22:93.28 58 ll! 52 03 06:58 

t 

52 88 22 99 28 58 JLL 93 03 06 88, 

shows the interrupting groups are 93 coupled with 99 and 93 coupled with 52. 
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Since tiie parallel passages In position a 30 and c 14: 

4l [oo 25 85 ] 52 33 11 £2 22 
17 ioo 25 85)99 33 11 88 T1 

show interruption by cipher groups 52 and 99 , It Is natural to assume that 
93 =-99 = 52 and that v& hare variants. 15118 assumption Is supported by the fact 
that the other parallel passages are likewise interrupted by dinocses which recur. 
If the variants are thus reduced so that instead of the three different dinomes 
52 , 93, and 99 we always enter the least dinome 52 in the cipher text, it appears 
1 . That interruptions of the parallel passages now disappear 


2. That new parallel passages appear, which could not previously be recog- 
nized, e.g. in position a 9 , a 18 and d 28 ; 

Reduced text: 52 00 52 

Ciphertext; 93 7l\j>, 93\.00 30 , 52 00 30 

or in Position b 21 and c 11 ; 

Reduced text: 17 17 17 

r~[ r~\ 

Ciphertext: 55/88 39 17, 55,^1 39 88 , 

with which *e nay regard the hypothesis of variants as proved, especially since 
the cipher groups arranged according to frequency after their reduction (see 
sheet 2 of the appendix) reveal both a normal frequency curve and a number of 
different cipher groups corresponding to that of a simple substitution. 

With proper evaluation of parallel passages the use of variants affords no 
protection agains t solution of the system; all that has been achieved is that 
tiie m i ni nun amount of traffic required for solution is somewhat greater because 
short texts do not always provide fox the parallel passages requisite for the re- 
duction of variants or, to put it differently, interpretation of elements assigned 
more than one group colls for somewhat more cipher text. Assuming that there 
are enough variants and - and this is still more Important - that foil use is 
made of them in enciphering, this system can offer some degree of security when 
transmitting a short message. 

Full utilization of the advantages of variants is quite difficult in prac- 
tice since both the frequency peaks for the cipher elements must disappear and 
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parallel passages must no longer be recognizable as such, fere we have our 
first example of the fact that the theoretical security limit cannot be attained 
in practice, dus* to the difficulty of following out the rules for enciphering. 

Consistent progress in the use of variants leads to full utilization of all 
the possibilities of the dlnorae substitution, namely the so-called hundred ele- 
ment substitution ( Hundert-Eleaaite-Cflsar ) . Since this substitution may proper- 
ly be used not merely to provide several variants for frequent plain elements 


but also to provide groups for frequent digraphs and trigrephs and frequent 
syllables, it is also called syllable substitution. ( Sllbenc&aar ) 

In Appendix I A 3 b on sheet 2 are given the encipherment and decipherment 
tables for syllable substitution. It contains in detail: 


1 group each 

2 groups each 

3 • 


15 letters 
10 * 

1 letter 
3 Umlauts 

2 mark© of 
punctuation 

29 digraphs 1 group each 

3 2 groups each 

22 syllables, articles and words 


15 groups 
20 groups 

3 " 

3 * 

2 groups 
29 " 

6 " 

22 " 

100 group s ’ 


Total 

In the sample text on Sheet 1 of the Appendix the parallel passages of the 
plain text have been designated in the same manner. Comparison with the cipher 
text shows that these plain text repetition# can no longer appear as parallel 
passages in the cipher text if proper care is taken in enciphering and if the 
cipher text does not exceed a certain length. 

On sheet 3 of the appendix is a 2-place group count of the cipher text. 

The arrangement of the cipher groups according to their frequency below shows 
a well equalized picture. Since frequency peaks and all recognisable parallel 
passages have dropped out, the system can be regarded as secure for 
messages of limited length, if proper care is taken in enciphering the text. 

But as soon as the text attains a length which no longer makes it possible 
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to avoid 

parallel passages in the cipher text or as soon as frequency peaks 


agppe&v uhich give clues for attempts at decipherment, the syllable substitu- 
tion looses all security because the entire system is readily solved once the 
first break has been made. 
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Plain text 


0 Cipher text 

SBf 


’tf JU u,i2X^ 




' ■ ) i 

y i 3 v r t m s py c i y r b * g t o / l, i y r k )- i <3 »-’ 



dL H, & /f £/■ c 4- T /<y /C /f ,£. /tz/rt £1 « ^ ,C <T 3 /£- *'-«-X,e a) '*v£~ 

Off SLOT V/*SZ SZ C /f- /? 

39 <%3m V cr/TSlbiSttfJfH 00 x^33 Y+-# Jtf bi il bidf 

‘‘ " ■* ^ — 1 t — *-— r- 1 — a * ~ ,; ~ 1 


/» 


/lyr^i/' Co 0 6 rj rto (y .j c. {, C c C t • f c d z * £/J t 

XL /?-«. 0 /I- L 3 W S 2 

■tfftffil ii/V it^j -eg St ot) *? # $3 ar&iQJlty/Hi 7UT5S 

l-il JtLeak^ J — r> ~^' * 

*, j £. Ss v" 4 / A £, m s** cS 4 ^ & Ss A O' r I ^ ^ £- >i fl” *£ ‘Y'*o '* / ? fc " 

0 fT sz ft ^ fr fr R /^tfzr /?- 

f*- */ J?.# 315 rt VH H 35 iTfy 39 tf tViSKSS 33_// 3* ?/ XT.*- 

-* ^rT 1 “ 






■-r4 


1 

- - - ->» X X.' ir ^ -t ‘."V X<_ <J -r- *P- £ X /£ ^ V4 (3 J-A~ A <■ vfc 

otrsi /t (nr . 
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4. Dlgraphic substitution ( Dear Paarcgbar) . 

She striving for greater security led to the attempt to start not with a 
single element hut with a digraph and to replace plain digraphs by cipher di- 
graphs* In Appendix I A k a sheet 1 an encipherment table has been developed 
for tills digraphic system, -vith a decipherment table on sheet 2. This system 
is called the Deutscher Paarcfisar (German di graphic system) . 

On sheet 2- of the appendix a plain text had been enciphered with this. 

The repeated digraphs and parallel passages disclosed by the digraphlc count 
on sheet 2 have been aar&ed and provided with eppToplate line indices pointing 
to the preceding and following occurrences of the same passage. A comparison 
of the parallel passages Bppearing in the plain text with those appearing in the 
cipher text shows that the parallel passages of the plain text appear in the 
cipher test onlywhen they stand at an interval of 2 or a multiple thereof or * 
to state it in more general terms « when they are in “phase" . 

To e^lain the concept "phase" (Phase ) it is necessary to explain first the 
concept "period" ( Periods ) . As tile period of a system we designate the least 
Interval after which a genuine parallel passage may reappear in the cipher text. 
A repetition in the cipher text is termed a. garnrine parallel, passage when the 
repetition in the cipher test the text correspond to one another* Two 

passages are then considered to be . in ph > v s when they occupy the ««wns position 
within tile period. 

.. 1 . • ■ 

Th the present case two passages of text are in phase when they stand at 
an interval of two or a multiple of two. 2-farebver plain text repetitions appear 
as parallel passages in their full length only when they extend from the begin- 
ning of the period to the end of another period. On the other hand the first 
and last element will not appear in the parallel passage if It extends beyond 

the beginning or the end of a period. 

, • 

Tilth tills system we meet for the first time the phenomenon that cipher 

text repetitions do not always indicate plain text repetitions as was the case 
with all sinple letter substitutions. In line 6 column 26 to 30 the cipher text 
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ua ua does, to be sur© correspond ini the plain text to a digraphic repeat ne ne; 
on the . other hand in line 1 colomn 12 to 15 and line 2 column 4 to 7 the repeat- 
ed digraphs yn yn and yc yc respectively do not correspond to repeated digraphs 
in the plain text because the first and last elements of the parallel passages 
always extend into two different periods. This likewise explains the earlier 
remark that cipher text repetitions ere only to be regarded as parallel passages: 
when they are of a definite minimum length depending on the system and the amount 
of traffic. This minimum leng&ft must be so chosen that the parallel passages 
to be utilized 'sill all or at least predominantly be genuine parallel passages. 

Sine® in the present example the number of parallel passages - two textual 
repetitions each 10 elements long ® does not suffice to determine regularities 
in the length and interval of parallel passages with any certainty, it is necess- 
ary t® reswsrfc to digraphs. There is no objection to doing this if one is aware 
of the extent to which digraphic repeats stay represent false parallel passages, 
so that corresponding deductions will be drawn only from the average or the 
majority of all results so as to avoid .reaching false deductions as a result of 
evaluating fals© parallel passages. 

Information regarding the ratio of genuine parallel passages to false para- 
llel passages in our present example is afforded by a comparison of the two 
counts jsa, sheet 3 with the chain count on sheet 2. A study of the total of 120 
repeated cipher digrams occurring in the present example shows that 71 di- 
graphic repetitions extend ffrtm the beginning of the period to the end of the 
period while k9 repetitions run from the end of one period to the beginning of 
a second period. 

Thus the first 71 digraphs represent ghuiae ; parallel passages while the 
remaining k9, Insofar m digraphs are not concerned which stand within genuine 
parallel passages, are not genuine parallel passages. ; ' 

No w if the number of intervals is checked which can be derived from these 
digraphs, it appears that 
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1. The 71 digraphs yield Jh intervals among themselves all of which are 
even numbers;. 

2. The 49 digraphs, although they are not genuine parallel passages; 
yield 30 intervals which are likewise even numbers; 

3. The 71 digraphs and the ^9 digraphs together also yield only 23 Inter- 
vals which are odd numbers* 

Since “between the 120 digraph repeats there are a total of 127 intervals, of 
which 1C& are even, the correct result stands out so sharply that the study 
may' be extended to include all digraphic repeats*/ 

On sheet 2 of the Appendix the lengths and intervals of the parallel pas- 
sages, including repeated digraphs, are broken up into their least factors and 
the number 2 has been recognised as a common factor. 

The analysis of the German digraphic substitution chows then the following 
characteristic s • 

1. Ho linguistic frequency of the single elements of the cipher texts. 

2. The number of. parallel passages including all repeated digraphs 
corresponds on the average to half the linguistic frequency. 

3* The parallel passages in their length and intervals show the number 2 
as a common factor. 

Their length, depending on the position In the test, may be as much as 
two elements Shorter than the corresponding repetitions in the plain 
text. 

Consequently it stey be stated that the security of the German dlgrephlc substi- 
tution is greater than that of any simple substitution. Nevertheless the German 
digraphic substitution can be used only within very narrow limits if its security 
is to be maintained. With a certain amount of material interpretation based on 
digraphic repeats and the frequency of plain text digraphs ia no more difficult 
than the interpretation of the sisple substitution. The amount of 'material will 
hardly exceed one to two pages of text. 
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In practice, therefore a new digrsphic saibstitution should he cat tip for 
every message of medium length. Acs experience shows, the time required for 
this is considerable because, there are numerous sources of error both In setting 
up the enciphe r ment teble and setting the corresponding decipherment table. 
The time expended in producing cryptographic material is, therefore, in no 
proper ratio to tee possibilities of use. 

In this respect a similar method; namely the English digraphic substitution 
(Playfair cipher), has great advantages over the German method , because the 
production of cryptographic material is very simple and requires only a few se- 
conds.' . 

For enciphering and deciphering, a square with 5 x 5 ~ 25 cell© is used in 
which the letters of .the alphabet without 3 (which i® always replaced by i) are 
entered in any desired sequence. Encipherment follows these rule®: . 

1. If the . two plain elements to be enciphered stand in a horizontal row of 
the square, the letters standing to: the right of the plain elements are selected 
in tee same order as cipher elements. The first letter at the left end of tee 

t 

row is considered .to be tee letter at tee right of tee one at tee right end' o £, 

* / ' • 

tee row. 

K ' 

2 . If both tee plain elements are in one column the letters st anding below 
teem are token as cipher elements . The top letter of tee column is considered 
to be tee letter below tee lowest letter. 

3* If the two plain elements to be enciphered are In different rows 
column® then tee cipher elements are those letters which with the p3aln elements 
form the comers of a rectangle . The letter above or below tee first 
element is regarded as tee first cipher elemen t 0 
If tee square has tee 25 letter© of the alphabet in tee sequence; 



abed© 
f g h i k 
1 ra n o p 
a r s t u 
v w x y 2 
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tben according to dhe rules: plain ab « cipher “be, plain ado cipher be, 
plain ae ® cipher ha, plain af s cipher fl, plain al« cipher fq . . 
plain avo cipher fa, plain ag * cipher fb, 

plain ar m cipher qb and. plain 3 £s 5 ^cipher vp etc . »• - 

The ease rules, egoprapriately isjdified, epplyr in deciphering, ■' 

Since according to these rules a doublet, i .© . a digraph consisting of two 
lilce letters, cannot he enciphered hy the square, it is necessary to doctor the 
plain tent of Appendix 1 A 4 b before encipherment in such fashion that doublets, 
if they do not divide between two - periods, be separated by inserting an s. 

Analysis of the cipher test yields the ease results as with the German dl« 
graphic substitution. However other phenomena occur due to the fact that the 
English digraphic substitution shows a systematic character d ue to the »«<> of 
the cipher square. As the presentation on sheet 3 of the Appendix endeavors to 

show, this structure causes 

• • «• 

!• That only 600 different digraphs are possible in contrast to &J6 di- 
graphs of the Gossan digraphic substitution, because the alphabet con- 
tains only 25 letters and doublets drop out as digraphs; 

2. That of the 600 digraphs all those which do not lie in the sane row cap 
in the sexes column of the square, i.e. 400 digraphs, are reciprocal and 
reversable. 

I.e. if 


plain eb s>: cipher ur, then the reverse 
, plain bait* cipher ru, is correct. Furthermore, 
dtt© to the reciprocity, we also find 
plain ur ® cipher eh arid 


plain ru« cipher ba. Bence if one of these I $C0 digraphs is 
interpreted, 3 others follow automatically; 

3» That the remaining 200 digraphs formed of letters in the seme row os* in 
the same column are never sable; hence 
plain be « cipher ub, and 
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Hence In this case each Interpretation yields 2 digraphs. . , . 

Consequently only 200 digraphs need he interpreted in contrast to of the 
German system. 

Furthermore the regularity Inherent in the English dlgrt&hlc substitution 

* * v 

permits the reconstruction of the cipher square on the basis of a few interpreta- 
tions. Such a reconstruction of the square has been made on sheet k of the 
appendix by Idle aid of 17 digraphs which are assumed to be known. In this ex- 
ample* it follows from equation 1: . 

Pl a in be s cipher ub, that these three elements are either located under one a- 

u 

nother in the colomn as b or side by side in the row as e b u. From equations 

G 

2 and 3 we also get two possibilities each. Since the third equation cuts into 
the first two in one letter in each case, 
we get a grouping of these equations as 

u a g h 

s b or e b u 

g e v v 

h 

From equation h it appears ' that only the second form is compatible with this 
equation so that we have as correct fragment of the square 

s g h 
eh u k 

v ' 


In this fashion the square can be further developed with each new equation as 
following the colored markings in the .Appendix clearly shows until xre have it 



s g h z o 
p e buk 
v m i c 
f q d t n 
y 1 r a w 


a 
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Since only the letter x remains for the -vacant cell this can he supplied. 

This square represents a displacement of the original square toward the top and 
sidej/i its effect is the same. 

ly-' 

In summing up we may say that the English digraphic substitution has some 
advantages offer the German digraphic substitution in the preparation of crypto* 
graphic material hut that the characteristics of the square result in far less 
security so that material enciphered with the English square must he kept less* 
if the bee® degree of security is to he maintained. 
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Possibilities and regularities of the Playfair. 
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digraphs which cannot occur 

digraphs made up of letters from the same row or column, 
digraphs made up of letters from different rows and columns. 
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5* Substitution with culls ( CiUsr mit Blender ). 

Tb& attest described in Appendix I A 5 a to give the simple substitution 
greater security takes & different course. Here so-called nulls are introduced 
at optional positions in the cipher text, in this case the digits 4 and 9 , Vhich 
were not used fcr ’he substitution alphabet and which are left out of account 
uhen deciphering. Aa a result a diname group count fails to yield, a character- 
istic substitution picture ( see the count on sheet 3 of the Appendix) . Instead 
of the 2-place chain count used hitherto a 4-place dispJacement count ( vieratel t. 

Varschiebestatistik ) (see sheet 2 of the appendix) must be undertaken in or- 
der to discover all the parallel passages. The 4-place displacement count, 
assuming a cipher text 

01234567^91234 etc., is made in such fashion that the folio-wing 
groups are counted one after the other: 012 3, 123 4, 234 5, 3456 etc. 
If the designation of the lines of the count is 1-place, then the last three 
places of the group to be counted are entered on the line; if the line designa- 
tion is 2-place, then only the last two places of the group are to be entered 
etc. (of course for the border line case where a 1-place letter system is in- 
volVted as in the case of a ©irrole letter substitution. the 1 -place chain count is 
like the 2-place displacement count.) 

The parallel passages disclosed by this displacement count show various 
interruptions by single elements in the text at one point to which no othsT* 
elements correspond at the point where the repeat occurs ( see compar J sou of 
parallel passages on sheet 3 of the Appendix. ) 

The couple te analysis of a substitution text with scattered mill* has the 
following characteristics: 

1. The 2-place group count does not show alphabetic frequency. 

2. Sam ease group count; with a displacement of 1 , i.e. omitting the first 
element, gives a similar picture( sheet 3 top and center). 

3. Common to both counts is the low score of certain columns, in this 


case columns 4 and 9 . 
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k. 15ae displacement count shows tip parallel passages with interruptions 


showing additional elements to which nothing corresponds in the 


counterpart. 

5* *Eoe intervals between parallel passages are odd even. 

6. Hie length of the parallel passage#, omitting the interruptions , is 


2-place. 

Careful evaluation of the parallel passages is important for the recognition of 
the null. As soon as one suspects that a null nay be present, it is easy to 
find confirmation. 

Besides this null inserted at arbitrary places, the so-called wild min 
( wlldm Blender ) , there is the systematic mm ( syet^m^tischen Blender ). 

As its name suggests, this null is Inserted at definite, prearranged positions 
in the text. Since the position of the null is fixed, any digits may be used 
for the purpose. 

In Appendix I A 5 b is given an example of this procedure with a systematic 
null in columns 5, 15, and 25- In contrast to the wild min both parallel 
passages show interruptions and the position of the interruption in the parallel 
passage may vary. If two or more interruptions appear in parallel passages, the 
intervals between the interruptions will be the same. Their position within the 
parallel passage nay be displaced with respect to one another. 

In analysis the regular interval for all interruptions is the most important 
characteristic . 

Since ours a null, whether wild or systematic, has been recognized, only a 
simple substitution remains, this device cannot be regarded as an effective 
improvement on the simple substitution. 
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6. Monome-dinome substitution - Uechselstelliner Zahlwncflsar . 

Based on the same principle as the null. , namely the disguising of the phase, 
is the monome-dinorae substitution where the (cipher) groups vary in length as the 
name indicates. The substitution shown in Appendix I A 6 has l— and 2— places 
with the freouent elements e, i, n and r represented by the single digit values 
0# 3* 5# and 8, v/hile all the other elements are represented by 2-place groups. 
The 4-place displacement count given on sheet 2 of the Appendix reveals the 
the parallel passages of the enciphered text on sheet 1« As is to be expected 
with this system the parallel passages show no regularity either in respect to 
length or interval (see sheet 4 of the Appendix) . Since the length of the 
parallel passages may be odd or even and lengths differing by only one element 
occur, we can deduce that the system has groups of differing length. VJhich 
cipher groups are monome and which are dinome is shown by a comparison of the 
parallel passages. Thus a comparison of the passage 9 6 3 0 7 4 with the other 
passage 9 63 7 4 reveals that 0 is a 1— place element. 

Since in line b of the cipher text the passage 
3527775444931s separated from the parallel passage 
9771096396 only by a 5, we learn that 5 is a 1-place element. 

If these two monomes in the cipher text are designated as 1-place, we learn 
from parallel passage 352777544493 that 3 is also a 1-place cipher 
element and then from the passage 58396307447 etc. that 8 is a 
1-place element. 

After the four cipher elements 0, 3, 5 and 8 have been marked off as 

monomes in the cipher text, we have left between them only passages of even 

length, a sign that we have now discovered all the 1-place cipher elements. 

After we have determined the length of the cipher elements, all the 

elements and groups occurring are easily identified in the square on sheet 3. 

The group count on sheet 3 then gives a clear picture of a substitution 

alphabet so that the rest of the solution causes no difficulty. In 

respect to the relatione between the length of the plain text and that 

of the cipher text the monome-dinomo substitution occupies a middle 

position between monoalphabetic or digraphic substitution on the one 
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hand and dinome substitution on the other* The ratio between the length 
of the plain text and the cipher text is 1 : 1 for the simple mono- 
alphabetic substitution or the digraphic substitution and 1 s 2 for the 
dinome substitution but is approximately 1 : 1-1/2 for the monome~ 
dinome substitution if the monomes are used for frenuent element s<> 

Even though a study of the parallel passages permits us to recogiize 
quickly that the groups differ in length and consequently the security of 
the moname-dinorae substitution is not very great even when its use is 
closely restricted, we must not an that account underestimate the principle 
of using groups of varying length* Since the use of varying lengths signifies 
a constant interrupt ion of the systematic character and since systematic 
structure lessens the security of any system, the principle as such is good* 
The use of this principle is all the more successful when a system yields few 
parallel passages because it is then more difficult to recognize the use of 
the principle than in our little example, provided it can be still recognized 
at all* 
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7* Poly a lpha.be tic subs ti tuti on with interrupted geriod ( fier Springcasai ^ 
•:ith the possibilities already described a certain high xvater mark had 
been reached for the development of the 1-place monoalphabet ic substitution 
and the dinome substitution. The further development of substitution systems 
could proceed in two directions. 

Either the monoalphabotic method could be expanded to include two or more 
letters and the din cme expanded to three or more digits in order to further 
extend the method employed with some success in the syllable substitution or 
else several substitution alphabets rather than one could be used to encipher 
a textj that is to say one either vent over to systems which made possible a 
greater number of variants and also the encipherment of greater amounts of 
traffic without endangering the security of the system or else by employing 
several substitution alphabets one reduced the amount of material enciphered 
by a single alphabet and at the same time reduced the number of parallel 
passages. 

The former course leads from the substitution alphabet to the code. 'A'e 
shall discuss this possibility in connection vdth polyalphabetic substitutions 
because it has become the practice to differentiate the substitution alphabet, 
which works primarily with the individual element, from the code, which centers 
on the word, although basically there 1b no difference between substitution and 
code. 

A change of alphabets when enciphering a text may take place only at 
certain intervals so that there are always several successive elements 
enciphered by one alphabet before one proceeds to the use of the second 
alphabet. Thi3 method has been given the name S pr ingc&sar because in each 
case several columns are skipped before a change (of cipher alphabet) occurs. 
This change may be systematic, i.e. after a definite number of elerasnts or 
columns, or it may be undertaken at varying intervals not fixed in advance. 

In the latter case it is necessary to indicate the use of a now alphabet by 
certain groups, so-called indicator groups, so that the decrypt er* may know 
when a change occurs and which alphabet has been used. 

The significance of the indicator group is to give the decipherer certain 


65 




Doc ID: 6592461 


TOP SECRET 


clues to the system employed; in particular the indicator group shows ■which 
of several available systems is used and in what manner it is used. For this 
reason it becomes of great significance for the unauthorized decrypter if he can 
separate the indicator group from the rest of the cipher text and learn its 
meaning from its structure, its frequency, the time and position of its occur- 
rence or other characteristics. 

In Appendix 1 A 7 a the three cipher alphabets on sheet 2 were uued to en- 
cipher the plain text on sheet 1, using alphabet I for columns 1 to 10, Alphabet 
II for columns 11 to 20, and alphabet HI for columns 21 to 30. The parallel 
passages have been discovered by a one-place chain count (dlgraphic count). Th» 
resulting picture is not equalized, but shows no linguistic frequency curve. 

The parallel passages are interrupted . Their study reveals no regularity in 
respect to length or intervals. Since all the rather long parallel passages 
show interruption and the longest one stowc two interruptions of like length, in 
each case with the same interval of 10, some regularities can be inferred. 

This Is confirmed either by writing the cipher text out in a width of ten elements 
when all interruptions of th parallel passages occur’ either at the beginning or 
the end of this ten column block, or when the distances between the correspond- 
ing interruptions are counted. 

1. From the beginning of the first interruption to the end **f the second, 
i.e. including the interrupt Ion, and 

2. From the end of the first interruption to the beginning of the second, 
i.e. excluding the interruption( sheet 3 of th appendix). 

The study of these intervals then reveals in each case for one of the recovered 
interval values the factors 2 x 3 x 5 >30 as common multiple. We reach the 
same result moreover either by adding together the Intervals of a parallel pass- 
age and the length of their interruption or by subtracting them. The number 30 
thus obtained along with the interval 10 found for several Interruptions within 
one parallel passage shows the number of alphabets to be 3. 

The most Important characteristic of the systematic SprlngcSaer is the fact 

AA 
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that the intervals o f the interrupting parallel passages give regular inter- 

*/ 

vale if the number of interrupting elements is added or subtracted. The re- 
gular interval consists of the two factors; the change interval, and the num- 
ber of alphabets. The change interval is determined either by the interval 
of two interruptions within a parallel passage or by superimposing the cipher 
text with a columnar width ouch that the interruptions to the parallel pas- 
sages form the beginning or end of the rows. 

In Appendix I A 7 b, we have an example of the unsystematic Spring cSsar.. 

Pour dinome substitution alphabets are employed to encipher the plain text; 1-place 
and 2-place indicator groups show the starting point.; (sheet \ center ) 0 The 
alphabets are derived from one another by following a definite route and can 
therefore be reduced to one another as will be shown later (sheet 1, bottom). 

She 4-place displacement count given on sheet 3 of the Appendix shows no 
linguistic frequencies in its totality. The parallel passages (see sheet 4) 
are predominantly even in length. The intervals are odd g™* even. It is 
striking that several rather short parallel passages follow one another in 
che same sequence and the interrupting passages either agree absolut el y in 
length or differ but little from one another. Hence if the Interrupting pass- 
ages are subjected to close scrutiny, it appears that as a rule the one inter- 
ruption begins with the number or with the group with which the corresponding 
interruption ends. If these repeated elements or groups at the beginning or 
end of the interruption are marked in the cipher text, then, Jf the y are not 
counted, there remain; 

1. Only even parallel passages, 

2. Only odd intervals between parallel passages, 

3. Even lengths of the passages interrupting the parallel passages. 

If the 1 end 2-place groups thus marked in the cipher text are regarded as 
indicators announcing a change in alphabet, this explains the interruptions in 
the parallel passages. If the count of the cipher text is divided up according 
to the four indicator groups, we get a normal alphabet curve for each indicator 
(see sheet 5). 


67 


TOP SECRET 


Doc ID: 6592461 


TOP SECRET 

• • 

A» far as the security of the systematic or unsystematic Sprlngeflsar is 
concerned, it is possible to multiply the amount of text permissible for the 
monoalphabetic substitution at least by the number of cipher alphabets used 
without having to fear any loss of security, provided the alphabets cannot be 
reduced to a common alphabet before solution. 

Actually, however, the permissible a&j>uub of cipher material can he in- 
creased to a far greater degree than is indicated by multiplying the text 
length permissible for a single alphabet by the number of alphabets , the less 
the interval between changes ia, if a certain ratnirnm number of S pringeSsars 
is employed simultaneously. If these conditions are met, the number of para- 
llel passages is greatly reduced and the agreement between the plain- text pic- 
ture and the cipher*- text picture characteristic of monoalphabetlc substitution 
is so broken up that it can no longer be recognized. 
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Parallel passages 
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4- place displacement count. 
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Hour If the change Interval is farther reduced, this leads ultimately to 
a change of alphabets from element to element or from column to column. In 
this case we speak, of a Spaltenctear (columnar Cisar ). 

In Appendix I A 8 a three dlnoma substitution alphabets, derived one 
from the other, have been used in encipherment. The two place count rads on 
sheet 2 of the Appendix in tie number square shows only 29 different 2-place 
groups. This clearly reveals a 2-place character of the system so that a 2- 
place chain count is sufficient for a study, of the cipher text. 

The breaking up of the Intervale between parallel passages shown on page 
3 reveals a common multiple 2 x 3:6. Since a 2-place system is involved, this 
means that parallel passages can only occur at an interval oS.'-j* iolioans. The 
complete analysis would then run: 

1. The total cotint does not shoe linguistic frequency. 

2. The frequency of parallel passages is less than in the plain text 
(theoretical frequency V z with x cipher alphabets). 

3- length of the parallel passages la a multiple of 2. 

k. Intervals between parallel passages are a multiple of 2 x 3* 

A group count of the cipher text distributed over three columns (sheet 3 )> shows 
normal frequency for each column so that solution is similar to the solution of 
a simple monoalphebetie substitution. It is helpful to note the frequent cipher 
digraphs because this facilitates the transition from one column to the nest. 

The ©sample given in the following appendix I A 8 b corresponds to the pre- 
ceding in its method and analysis except that the five cipher alphabets were de- 
rived fsom one another by a different method to be explained later and that in 
so doing sixty different cipher groups arose which only appear in part in the 
count of the individual alphabets. The effect of the systematic character, due 
to the derivation of the alphabets from one another in both this end the pre- 
ceding esanple, on the security of the system will have to be investigated 
separately later on. 
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The further development of the Spaltenefisar lea to the so-called Tritheim 
table, named for the Abbot Tritheim who first recommended its use in the Middle 
Ages. The table shown in oppendix : I A 8 c eheet 1 consists of a square with 26 
columns and 26 rows Designated in each case by the coordinates a to z and contains 
Hie alphabet 26 times, displaced by one element in each line. 'Hie vertical coor- 
dinates correspond to the plain alphabet, the horizontal coordinates to the 
column designations, while the square itself contains the cipher elements. 

The encipherment of a plain test is accomplished by first providing the 
elements of the plain teat* aerially with the. column designation from A to Z. 

Then each plain element can be enciphered with the associated cipher alphabet. 

While in the table on sheet 1 both the single alphabets In the columns 
with their reversed alphabetic order and the horizontal rows are arranged quite 
systematically in the sequence of the alphabet, the tables can also be ©on*-:.;' 
structed so that; 

1. As in the exasple given on sheet 2 of the appendix the individual 
alphabet in the colossus has no systematic structure but all the follow- 
alphabets are derived from the first by the some rule so that the rows 
always show the saxes random alphabet with a different degree of dis- 
placement. The rows are termed transition rows because the sequence 
of letters contained in these rows 'shows how the cipher elements of 
one columnar alphabet change in passing from one column to the next. 

2. As in the example on sheet 3 the alphabets in the several columns no 
longer show any outward kinship although they have been derived from 

one another by Hie same transition sequence as in the example on sheet 

J \ . * 

2. This teble arose by transposing rows of Hie table on sheet 2. 

3= As in. the exaaple on sheet 4 the columnar alphabets always show the 
same sequence tfS letters with a different degree of displacement but 
Hie* adjacent alphabets can no longer be derived from one another by 
the aid of a transition sequence. This table on sheet 4 arose by 
transposing Hie columns on sheet 2. 

7* ' 

© 
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V. As Sat the example on sheet 5 the columnar alphabets appear utterly 
random and do not allow any common transition sequence to be recog® 
nlzed. KewrUieleBO a systematic structure of the table can still be 
recognized inasmuch as each cipher element occurs once In each row and 
in each column. This table arose by a transposition of the columns of 
the table on sheet 3 'which in turn was derived by transposing the rows 
of the table on sheet 2. 

5. As in the eaasgle on sheet 6 each columnar alphabet is set up separate® 
ly and Independently of the others, so that an absolutely random table 
has resulted which Is like the original Tritheim table only in outward 
form and in the number of alphabets but is otherwise a random poly® 
alphabetic system. 

Before taking up the question of the security of these tables, .two other 
systems will be mentioned which belong here structurally, namely the so-called 
Cojaaunist system and the so-called book encipherment. 

The so-called CoaBaunict system consists in enciphering -very brief messages, 
often merely rnaass or pass-words, by mans of a key number by starting with the 
plain test letter and going ahead as many letters in the alphabet as is indicated 
by the appropriate digit of the key number. Thus if the key number reads* 

12345 

and the plain text; . h e u t e 

then the cipher text reads: i f vaf 

g w v g 
, . . svh 

' x i 

• ‘ • • ’ 3 

= 1 g x x J . In Appendix I A 8 d several short texts have been enciphered by 
this method. Mow whether the encipherment .is undertaken by counting ahead so 
and so many letters In the alphabet or whether the cipher letters are read off 
the table at the upper left on sheet 1, what is involved is no thing other 
the Tritheim table with t he limitation that instead of 26 col umnar alphabets 
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only 10 ere employed. The lO-coluan tabl^ shown on sheet 2 Is constructed like 
the Trithelm table and can he used in the system under discussion. 

Regard in g the security of this method of encipherment ve may say definitely 
that a single cipher test equal to the key number cannot be solved without know- 
ing the key. It' is. a different story if the same key number is used a number 
of times .and the unauthorized decipherer has several secret tests available. In 
this case it Is well to write below each cipher test the possible plain test 

letters as has been done in Appendix I A 8 d. If now in the second sample test 

\ * 

the first possible plain latter is y, 
the second w n " " x, 

the ninth " " " " q, 

then it may be assumed with a high degree of probability that the plain test 
does not begin with one of these letters. Correspondingly In the third sample 
text the 8th possible plain letter y can be ruled out as improbable. Since on 
the other hand the correct plain test letter in all. the sample texts must stand 
on the same level,, the 1st, hod, 8th and 9th letter can be ruled out in all the 
examples as unlikely so that only the 3rd- . to the 7th and the 10th letter remain 
open as possibilities. After all improbable letters have been crossed off in : 
the second and third columns in the sbkb fashion, we. can proceed as follows: 

According to sample text 1 from among the remaining possibilities of forming 
digraphs in the first two columns, namely: 

k& ha ^ ku $6 3a tfr 3u 

id ^^ W p6 h& Itff pf bu 

jgi 0) ga pr gu pi) da j&f ftr du . 

only the digraphs: 

k& ku da ju id ha bn ga gu da du 

are plausible. Corresponding to. these digraphs in the other serple texts • 
we find: 

... ‘ . . / ' . . 

yjli vb yii uk th ph jr1> 

gL ■$£ qi <$k b6 al af sd. jtit & 

pa pu oa ou ml oa mu la lu $4 ^4 
m mi sa mi ^£1 ka ku je ju ga gu. 


2D 
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If we cross out the inprobable digraphs here ve have left only the column 
: . ha 

$h *■■■• 

al 

TSEL 

• ‘ ha 

with no elimination as the sole evac^mr. After solving the first two letters 
there is usually only one possibility left for the following columns so that 
the rest of the solution comes aat<Esatically, especially since with the third 
digraph we already begin to see word beginnings. 

Also the so-called Booh encipherment, shown by an ©sample in I A 8 e, is 
nothing other than the Tritheim table used in a different way. In the table on 
sheet 1 of the above mentioned appendix which is valid for the booh encipherment 
the letters A to Z have been provided with numerical values from 0 to 25 and/oar 
26 to 51. 

After the text from the book agreed upon has been written out beneath or a~ 
hove the plain text to be enciphered, the letters of the booh text and the plain 
text are converted into the numerical values of the table end added and the 
letter corresponding to this sum is entered as the cipher value as shown in the 
line of text on sheet 1 of the appendix. 

To show that here too we are merely dealing with the Trltheia table, the 
cipher values of this ©saaple have been framed in red in the square on sheet 1 
of the appendix whore the bool;). test indicates the columns and the plain text the 
row. The connection of the individual values framed in red through the remaining 
values of the alphabet yields the Tritheim table . 

In contrast to the Communist system it cannot be claimed without further 
ado that with booh encipherment a knowledge of a single cipher text does not 
permit the unauthorized decipherer to attempt decryption- To explain this fact 
three plain texts have been enciphered with the given booh text on sheet 2 of 
the appendix. The three resulting cipher texts have been continued downward 25 
times alphabetically on sheet 2 and laterally on sheet 3 so that from the .cipher 

. St 
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value 2 , far instance, the possible plain text values y z a b c 4 etc. axe de- 
veloped one after the other. 

As tilth the Communist system it is now necessary to try to pick out the 
columns which, when placed side by side, yield plain text, We must not lose 
sight of the fact that the cipher text row itself may contain plain text columns. 

2 . ‘ 5 • 

Starting with the first column 1 the other columns from 0 to 25 a re associated 
to this first column one after the other and the digraphs which look likely are 
written down. If to these remaining digraphs there is associated the third 
column with all its possibilities,, we either see the beginnings of plain text or 
it is dear that the first column of row 0 was not the correct initial column, 
in which case the ©sms experiment is tried with the first column of the next row 
and* of the following, row. Then the experiment is tried starting with the first 
column' of the 23rd row. The combination with the second column of all the row® 
appears as follows: ” . 

ur us \fa fa fa fa 'fa fa fa ua ub uc ud ue 

11 im in fa fa i)i ir is it ib fa fa. fa fa . 

ir is fa fa iv iw fa fa fa ia ib fa id fa 

uf ug uh ^ ^ uk ul um un ^6 up u£ . 

^ ^ lb ic ia ie if ig ih Ik 

if ig ih fa fa fa il im in io ip fa 

After striking out unlikely digraphs the following columns remain: 
ur us ul ua un 
il ia if ig ih 
ir is il im in 

From the 3rd columns we can associate to these remaining digraphs 
urt unt 

. \ 

ilr ihr 

ird ind • 

When we consider the 4th column we find as the sole remaining possibility 
unt® ihrt inde 

ih© continuation comes as a matter of course since from the mom ent when plain 

test can be recognized the rows supplement each other. 
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i of 3 letters can prove successful 
this culls SOr a greater expenditure 


What has 'been shown her© ■with ai : < 

• l 

with a depth of only teo letters 
of effort.- . 

But since the cipher text has been deceived from plain text and book test, 
the book test also being plain test; it is natural to try using this plain test 
for solution. Since the book test hsie shown which of the 36.'>pc®sifeQU?v.. 
degrees of displacement of the plain test is to be selected as cipher test, the 
cipher test line itself can be designated as a, the nest line 1 as z. the second 

line as y, the third ©as etc., Juct ao has been entered in red in the egpsn&is. 
Since the bock test -value & plain test value —cipher value, we mat also get 

cipher value $ plain test value a: book test value. Thus if frcea cipher value 
Sf»2Q or h9 fraa row 0 we are to got in m 1 a plain test value y»£& o r JO, 
the book text value according to the equation k9 (cipher s) # S& (plain y)<? 25 

" hi . 

suet have the value 25 and therefore corresponds to the book test value z. 
liking into account the book test values the initial column in row 23 

U Q 

would no longer read i but i . Bow all the other column® may be expanded, by 

i i 

this fourth letter and cur previously discovered plain test would now give us 
four columns a® follows ° 

deru 

unte , 

ihrt 

infla 

Introducing the line of book test with 3 cipher tests gives us b lines of plain 
test, with 2 cipher tests it gives us 3 lines of plain test and in case of a 
single cipher test it gives us 2 lines of plain -test available for study as 
described above. 

However, since solution is possible with 2 lines of plain test, a ©ingle 
cipher test ea» be solved. In practice the work is greatly simplified by the 
fact that the possible lines of plain test are no longer written cut one be® 
neath the other in an alphabetic sequence a, a, y, s etc., but the associated 
bcokktest values are arranged in the carder of alphabetic frequency, because then 
the columns most often used will stand at the top and will be tried first in 
our experiment. 
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Xf the c o3 vbbu&f substitutions thus far discussed are studied with respect 
to their security, the following defects are found iu -the several systems which 
have given the possibility of solution. 

The two pdyulphabstic substitution® in appendices I A 8 a and I A 8 b with; 
3 and 5 alphabets respectively could be solved fairly easily because the re- 
gular course of the alphabets could be recognized through evaluation of parallel 
passages so that all the cipher groups could be distributed to the appropriate, 
columnar alphabets. After this distribution the single columnar alphabet could 
be solved in a familiar sinner. 

It is clear that in these two cases the possibility of solution was- to be 
ascribed primarily to regularity in the use of columnar alphabet and only se- 
condarily to the small number of such alphabets. If, for instance, the three 
alphabets in appendix I A 8 a had not always been used in the same sequence 
12 3 but also in the sequences 13 2, 21 3* 23 1, 312 and 3 2 1 and these 
in turn had been used in irregular sequence, then in spite of the small number 
of columnar alphabets fur more cipher material would be needed before one could 
even think of analysing the system. 

In the case of the Communist system in appendix I A 8 d the use of the 
columnar alphabets in an irregular sequence has already bean realized through 
the use of the key nu m ber. The result was that the single cipher text could 
no longer be solved no matter ho v long it might be. If nevertheless two or 
three cipher tests in the same key lad to solution of the system, that is doubt® 
less to be ascribed to the alphabetic structure of the columnar alphabets be- 
cause the course of colution taken was based, on this alphabetic arrangement. 

The book enclphemant on its part combines the defect of the Communist 
system, namely the alphabetic structure of the columnar alphabets, with the de- 
fect of the podyalphabetic substitutions in Appendices 1 A 8 a and b, namely 
the us® of columnar alphabets in a regular recurring, sequence. Even though the 
sequence caused by the book text in the Use of the columnar alphabet® does not 
show the regularity of a constantly repeated limited digit sequence. 
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nevert hel ess the partial regularity, which is brought about by the plain lan- 
guage in the sequence of the columnar alphabet^ is sufficient to rob the book 
encipherment of the security requisite for the single use of the hook text as 
cipher key* 

« „ - t ’ i 

With this w© have already made two important basic discoveries regarding 
the use of all systems of columnar substitution: 

1. . The columnar substitution sWrt Ebsolutoly avoid any system in the 
•■■•■7.. succession of the columnar alphabets or oust fix it so that fro® this 

. system with a given amount of enciphered material no inferences ean 
be dram which might contribute to analysis end decryption. 

2. The columnar alphabet must not have alphabetic structure. We must 
consider a© equivalent to alphabetic Structure any systematic struct- 
ure which might be recognized, guessed, or the knowledge of which 
would lead to a solution of the cipher text. 

Hie second requirement is not as essential as the first, so long as there 
is no possibility that two or more cipher texSs in the same key can occur. 

These two basic principles do not, however, cover all the dangers which may 
arise in connection, with, the use of columnar substitutions; because the security 
of & columnar system can be greatly impaired not merely by a systematic factor 
in tiie sequence of the columnar alphabets and in the structure of the indivi- 
dual alphabet, but also by any systematic relations or ties existing between 
one columnar alphabet and another. Hie following study will show this. 
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Vu+tu+^c-dt, 

Pla^n 

Q, /r't cA, ct& g a!, q A £ *v*l jc A t, X'^'V 2 O O 


<*w r 

-K1* b-H <H llftH SS-#02toit3y&3tM*l WYWnoUYUSJlUtQtl 


Alphabets I 

• t 

tLST/H <n<rnt)Yfr** w ttsv 


*• ff 

Witty MU )%G9i>s#^nKW*±srA4aL 



<&-r- 0-/4 l % V x- 1> ? r 9 

v n\ v' in ^ v 



Determination of groups occurring 


Digr^phic count 

tf*. 

it*. 6u. tu a,. Ut, 

xz til*, 

au 157. “EE a*. w+~$rt 


0 

x x 

X X 

1 

X 


2- 

X 

X 

5 

X X 

X 

y 

xx 

xx 

r 

X 

X X 
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X X 

X X 

h 

X 

X X 

t 

X 

X 
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x x 

X 


K+. *U V* Hi VH-. 
hSc. T7T. M. V& }** -*/ 

) m*. it* au_ m-. wj, .In w 6 . m fH. 

JfgJ # — 


'9 * y * 


9-u. r$A tfinncscf. & % 


\ h* >y>. ul. u*. 

rtf. Mi 


} y *** ~ ^ **■ £& ^ 

lh *t. D 2 t,. itjt. LT 34 , <Of. i?ft ^5 ft. 


» *> t^s, U±. 

° S ) tetL 3* 

-H 7VTZL 


»S" 

>* 

t 3 

tv 

$ y 

9 3 


\j^ (^ v si. tU fca iSd 

^i<. Y j^ ^ 

I f 4. rt<. YjtL gjL&X £l, Wf* >r> 

Vy* »<x IfV it<. 'M<.. jV^i ~bt* i 
XUr. "ST 27S- 

3£c. fru.ytf. &*fL ^ Oij^ 'rTft 


^'V 




if* . -iEe . tfl* 
62a ^ 

^5c_ ^ 


£ ^ 
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Parallel passages 
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Plain text 



I A 8 b - 1 
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h an 
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V oij rig 
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yi isxi/r 
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Arm 
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i 
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Digraphic count 


I trA i ilk * c dS* /& 

| rt<. £d /u 
\fl\ZH srdi.r r 
1 nt ° 

/A K< 'tit. 

Wo. 

/r a 

LfA kit, h&£ fy/ft*. 
UiriJL 

1^4. 

ft*. 

02 *.y&t 


/ 5 

Sr 

rb 

i dfy 

’.-i 

S'b 

iV 

id. 

iy 

h 

35 

for 

*/! 

y < 

V' 

h 

H 

Vi 


\r+~*L Uj, 

■ rz 7F< 

I rTxpb u*L 

U> .Ca 


2% 


ri/ Y6y 
Ha * 

£&ifj *h£ 

£&> /*i 

M/r. 

*9*. At*. ’**’ 

Ah uMA 0 
*U- 

HUJSLWeJfi^ $tr r 
m. wto w*c n* ya<. 
£&*i£ 

2*~ 
nr c Mi 
cru 
iU 

KU. 

6*c 

n/>- 

su 

k 1+0]* 

it trp 

fids ' 

£>Tc LZJ- JYe.dte. 

rfZ££££AZ~~~ 

’ >is r M 

fS/r-'HJrCUL 

SYA >y V. 


r? | YZo /tp 

wj. nTf-ti* 

tU- SifjffA 

0 

lot 

SH. ^d SVk. 
0 )*. W/L Si* 

PM df+ 4 *. YAa 
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% /si 

W/. C5f 

rid. ■" ' 
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LI 

t> / 

tr 

cs 

M 
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XL 
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XT 

Si 
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rt 


St 


W*- 

(**>4, lit 
K*. r 
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eu ir^pfc yiu 

/sV 
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\ n t 
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' * j\ tiC 

\*5a 


__ 2 

U 


[ r-f 'tJx 

,*rjL 

ST, 5>« (, 2 d 

*y< FFZ ^ 

**fc <Ou . 5 Pc. -dg*. 

rtt-itrd ^ 

: <*>' ^ 7 


'r 


\U 


srp 

&rL 

/* 

ll irl tiA 

*| O 

'■<&+* i£t- 

i ***- 


3 r/z 


60 elements found ' 
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Columnar count of the cipher groups. 
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/ST^t ’^Z^A’Xlc 

Tritheim Table 

C P B F 0 n i J«_ 


normal alphabetic, reciprocal 

- Ml/ C /> H T V /^AyZ 


A 

l 

C 

t 

F 

0 

tl 

I 

3 

K 

L 

M 

V 

0 

V 

Q 

* 

S 

T 

V 
/ 

v/ 

\ 

J 

Z 


*r 4. A c ^ 

/T* <, 

X/ '* ^ ^ 

1 S'- 

cf<r !L , -r 

c f t 1 

Z- ^ 4~ t, /_ 

f>~ .f c, A c. 

f l Is /—% <K O’ 

l l k~ £, ' *\. A. 

>; r< - 
^A f 

t' fl ~T 
^ ^ z-/. r 

^ O t„ 

O -.w 

■ t *t V" > ^ 

/W V . *V" >■ 

1- f* -r 

< 'JKAT «£- ^ 

£,iT 

rr» *r <r 

*y '1*4. <4 

2* * S 

v- x / jr ^ 

•*A" ' w X •> ^ 

— ^ — i-n 

Ztfu 

Ztt* 

4l ^/>v Al ^ 

l' ^ 

t-yn* 

a ^ ./ * 

-y r 

/l ^ A -» ^ 

V* A 

/ Vt A 

V ^ /t 

b rr/i fc 

V^l i nr* 
* AT JL y T 
'* 1 / />v O'/L <y 

*> O' '/L 
k, /C O' 

F v"*- A * 
f *T - 2 T/V- ^ 
^ * T'-r 
t'AAa *~'j' 
A C 
A- v ^ 

^ ^ *- c Z e^ 

ft £ A Jr c Z 

«- 7 *-6~A C 
/ 3~ JL jr£_ £ 

V-1-*- *2-^ 
u r*-Zj* 

^ T^“ — 3 

At ' c “ c 
'c y s x 1 

t/A/v 

p 

/C A- C 

^ i V 

/) . ^ 

% / c A- 

Al/it' 

4- /. v' /’ 4. 

"Ar 

^ ^ A A r 
^ Af 

C ^ ^ 

(L C <>v O' 

T^r V- 't-'SL H 

z T cT lr 
r a ir u~~ O’ *~ 
4 ifr'i*’ v 
k '^ 1-4 tz ^ 

t- c *t 

*-\ 

dL jj ^ 

i 

“ ,c r; vr 

A A/ A 

cZ±<Z a 

*-cZt_A 
z- AcZ i, 

Aft ^ * ii *- ^ 

^ r 4ffi C\‘S*LO*.‘ 
^ aC ts 4- $, /- '.'a £. A. ' 
* cd,Vf - C,; /• c. 

^ ° x * ■ z 1 ? / - > 7 ^ 

O' Jl, V~ 4 ~fc~ 

>v ^ C- 

Cr 

^ >1 

tT nr- 's' A' . 

A '*« — . , --V- jt 

« T'X-'.’-z f: 

A‘“ y-i 
$ r- a, t <f, 

f^A-C Z 

ij 3ra~ rfL c 

**3 ~a-tr 
SrJC h £ ^ 


Plain text 


*zn)L-i A*-u 

ifI^ r g m S£fe co] 


Sample encipheitment : 

&"T -o A A & /) /t £, C *j «%. ^ 

^444 

1 1 £. c (f)4 ^ V 

as^^tyigK *• / 


Column 'l 

i /. 

Column B 

C • 

D ‘ 


I A 8 c - 1 



- TOP SECRET 

93 


Doc ID: 6592461 


^ FOP SECRET 


A 

h 

C 

D 

E 

F 

<* 

H 

I 

: 

H 

L 

M 

N 

0 


t 

w 

T 

1/ 

V 
W 
X 

V 
2 





Alphabet *= transition sequence 


A BC DEF6HI J «LMA/^PARiTiy\/VVXy^ 


<c a ^t A ** 

A k. £ /by 

v A A*' Z**^ A 
A /H/ A*\/ (^/ 

/A A 1 

(A k ^ v At 

■M 

i’ U Orl * 

u nr ji a, A 
vr / <L fl A'T 
(/ C ^ ^ 

/^l/ ^ J!' <^/^< 

Ay & 

^/*v PfAf'A 

nr A- ksK.sC 

k t K. c<- 

k<'£'<s i‘ 
Xs£s/C_s j y 

n> Z' C a 

/v (h Arv c- 

u *rL a* 
Vrgy a* p A 

1 / &s 4 /f 

4 , fl A AT & 

A A ^ & l 

\/cr a- / A^s 

^ WSsAr 
i-J Au^at-Js 

l Wp /v-/- A 

/V ^ nrp A, jc. 
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l* AlXs & Ct 

A*C £/ 

^ Cf 4 9 «rA' 

<s A ^ As*Z 
a' n^ 

'or *T ' w ^ 

/*vAi ^ /(? 

At *u.^ £ C 

fry *'*'/ 1 

$*a / ^i//j 

f_, 0 s {0 fl /C 

(*s Av A ir 

b '4 P 

■6 ^ 
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p/ t L' ^-/V" ^ 
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$■ Arjpk. 7 C p 
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'£, c//V/a' 

<>> a^tA *r 

/' < ^Aj tr ^} 

Vaa 

<« /*•+. 

«~dst sty 

't /b d"tr 
* 9 Art 
d*rr 

-t. * <?. 

4 , 

1 'Kv‘y' 

2 r J*As ^ at 

A 

um 
£Ar >kA */ 

'V-'^t, */£- 
yk.go re 
kv P V/j 

K, p <y 4 tr 
&d /!' >rA- 
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(v As ^ 

fv*v<r/ 
%,'h Qr/r/z- 

*, Yir si 0 L ft* 

^ A ^ 
^ sO- 

a~/l'A /W 4 - 
itA O' A- -fs 
A trjj- /"V 

orfy'rL x; p 
Jtr P p </ 
H Ap & j 
KjA * / r 
A/C f V/C 

& A 'f' X-x. 

aILa:* h 
y" / a“^ ^ 

A, ^ 

- A 

*^/t-rt <3 t'jj 

dt & A 

t 9 

6 *( 1 ,* L 
s 't *lA ±a 

irl ^fSA 

/ a. a. & <r 

a-p-G /O' £■ 
HA 

Cr& s//*s 0 

4 -tn^ ±Jv- 


Sample enciphepment : # # * 
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d^FrT^, $CJ 6 c 
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%)4 <r 

AS* (Tt. A~ 
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£& t',? %, 

,*v ^ 

*'*•©*''** 
+ H r ir /y 6~ 
£, 4-* £ 

M 'Tic. fc.4 

1 i_(g^ • 7 A 

du.%Z'*s, ^ 

f~ A /r *z~ lx. 

S' ^ S- '', r /’ 

irjtr j~^<L 
uT^ f ypCt J 

^ ^ «u 

Air JL 
Z jL*£o)r 

" X 

- 3 *■ *4- 
<-©/’ ^v( 

O - ’/^ 

1 S' 

iV 

/<1 r trW ^ 
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9. Redaction of polvalphabotic substitutions . 

As already mentioned in the discussion of the system employed in 

* ^ . 

Appendix I A 8 a the 3 columnar alphabets used there were derived ffcom 

* • 

one another. As a comparison of the three alphabets shorn at the top 
of sheet 2 shows these contain the same sequence of cipher values dis- 

. ' i *; 

placed cyclically* Vie can conceivi of this as if an alphabet from A to Z 
were inscribed on a strip of paper or a Slide and moved along a second 
slide containing the numsrical values underlying the above columnar alphabets 0 
The above alphabets can then be read off at a given setting of the alphabet 
as plain sequence with respect to this numerical sequence as cipher 
sequence,. 

The sanss principle could also be applied to the Tritheim table shown 

in Appendix I A 8 c } since this table; could also be read off from two 

* * * 1 

strips or from a device like a slide rule where the one slide contains the 
plain sequence from A to Z- of the coordinate column while the other slide 
bears the cipher sequence % to a, found within the square, inscribed 
twice so that all values can be read off in any position of the slide* 

The first columnar alphabet of the column A of the table would be set up 
on the slide when cipher z is set against plain A e The next alphabet B 
would be read off with cipher a set against plain B etc 0 Compared vdth 
the example previously given in Appendix I A 8 a the only difference is 
that the cipher sequence in the first case comprises numerical values and 
in the second case letter values* 

The t able shown on sheet 2 of Appendix I A 8 c can likewise be produced 
vdth such a slide whore the plain sequence would be A to Z and the cipher 
sequence on the slide would be cjrhumdtgiyvlapsosfnqv/bkxe * The setting *' 
of the slide would then be cipher c against plain A for columnar alphabet A p 
cipher j against plain A for columnar alphabet B, cipher r against plain A 
for columnar alphabet C, etc* It is then possible to enter the column 
designations ABC etc. beside the cipher values c j r etc*, or to alter 
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the column designations correspondingly# 

Regarding all alphabets which can be derived in this fashion it may 

be said that they depend on the slide principle because one alphabet in 
relation to the next merely depends on a new setting of the plain sequence 
to the cipher sequence on the slide rule 0 In contrast to a system to be 
explained later vie speak here of the short slide, because the slide . contains 

only as many cells as the alphabet has cipher values associated to pla i n 
values o 

In Appendix I A 9 a sheet 1 the three alphabets for Appendix I A 8 a 
have been listed as they were found by solving the sample text, Consequently 
the alphabets show gaps in the cipher sequences wherever certain plain 
elements of a colunsj did not appear,, 

If these alphabets are based on a different setting of the cipher 
sequence in respect to the plain sequence on a slide it can be Inferred 
that the cipher values of two alphabets on the slide which are associated to 
one plain value have the same interval as do all other pairs of cipher values 
of these two alphabets which are associated to one definite plain value, 

^ ^ is assumed that the two cipher values 62 and 68 from 
alphabet I and alphabet II, which both correspond to the plain value e, have 
an interval x between, it follows that the cipher values 68 and 94, which 
are both equal to plain 1, stand at the same interval x from one another, 
as do the pairs of cipher values 94 and 42, 42 and 06, 06 and 09, vAiich 
correspond to the plain letters s, a and d respectively in alphabets I 
and II, In this way fragments of the transition sequence between two 
alphabets can be established which contain only cipher values with the 
same interval on the slide. The fragment for the values just given reads 
62 ~ 68 - 94 - 42 - 06 ~ 09, At this point the transition sequence cannot 
be extended because the value 09 in alphabet I is missing due to the gaps. 

On sheet 1 of the Appendix all fragments of the transition sequences 
between alphabets I and XX, II and III, and I and III are listed and provided 
with the row designations 1 a » h, 2 a - g, 3 a -■ h. 
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A comparison of row 3 e with row 2 b shows that both sequences contain 

the cipher values 42 and 27 o But since sequence 3 e contains two other 

values between these two we must assume an interval between the values of. 
sequence 2 b which is divisible by 3 if we desire to unite the two sequences 
2 b and 3 e. 

On the other hand sequence 2 b and' sequence 1 a agree in two cipher 

values, namely 42 and 62, while in sequence 1 a the values 62 and 4 2 are 

separated by two additional cipher values and in sequence 2 b the values 
42 and 62 in the reverse direction are separated by one cipher value; a 
combination of these two sequences to form one sequence would presuppose 
that the direction of all sequences formed between alphabet I and alphabet XI 
is reversed and that the interval between 42 and 62 is divisible by 6, so 

as to take into account both the interval divisible by 2 in sequence 2 b and 

the interval divisible by 3 of sequence 1 a- The combination of these two 
sequences 2 b and 1 a into a single sequence has been carried out on 
sheet 2 of the Appendix- Into the resulting transition sequence can be 
introduced readily the remaining fragments of sequences lb, lc, Id, If 
and lgo If later on the fragment from sequence 2 a is to be introduced, 

we get from the interval 92 . - 09 the total length of the slide a3 29, 

since the interval from 09 to 92 is already fixed- If the fragments from 
the sequences 2c, d, e, f and g are then to be introduced, we get almost 
the complete cipher sequence from which only one cipher value is missing, 
although the transition sequences between alphabet I and alphabet III have 
not yet been taken into account at all. 

If, finally, the corresponding plain sequences for the three alphabets 
are produced, these sequences supplement one another until only four plain 
values are missing because they did not appear in the text of Appendix I A 8 a. 
Moreover in so doing we get through v => 04 the. value missing in the cipher 
sequence as 04 o 

The appropriate slide settings for the plain and cipher sequences thus 
formed allow us to produce the alphabets I, H and XXX • 
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A comparison of this slide with the original arrangement of the plain 
sequence and cipher sequence shorn on sheet 2 reveal s/that, due to the first 
arbitrary assumption of a definite interval, the values which are adjacent 
on t he original slide appear oh the reconstructed slide at an interval of 21 
from left to right or of 8 from right to left„ In spite of the different 
stznacture, the two slides have the same effect 0 The reconstructed slide is 
therefore termed an equivalent or substitute slide o 

Since the values which are adjacent on the original slide with its 
29 cells can appear on the substitute slides at the intervals from 1 to 28, 
it is possible to produce 28 different slides, each differing from the other 
but having the same effect, of which one will coincide with the original,. 

The example on sheet 3 of the Appendix 3hows that with an original slide 
of 28 cells and the derived substitute slide it is possible that with 1 
certain intervals several fragments of substitute slides will be obtained 
instead of an entire substitute slide,, From the comparison on sheet 4 of 
the Appendix showing? 

lo Length of slide, 

2« Interval on the substitute slide between adjacent values on the 
original slide, and 

3» Data regarding the parts of which the substitute slide is composed, 
it is apparent that the least common factors of the length of the 
original slide and the intervals between the values on the original 
slide which are adjacent on the substitute slide indicate the 
division of the substitute slide o Inversely from the number of 
parts of the substitute slide and the total length of the slide 
an inference can be drawn as to the interval between the values 
on 'the original slide e 

The 3 columnar alphabets derived from one another and shown in Appendix 
I A 8 b are based on the slide principle with this difference that the slide 
has for the 28 plain and cipher values not 28 cells but 100 cells designated 
on the cipher side from 00 to 99, in other words a long slide ,, The plain 
values are likewise on a slide with 100 cells distributed at optional 
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intervals and in any desired sequence* By setting plain a against cipher 
62 we get alphabet I, with plain a against cipher 75 we get alphabet II 
and with plain a against cipher 10 alphabet III etc „ Contrasted vdth the 

* * r 

short number slide the difference in a purely external respect consists 
in the fact that with a short slide the cipher text shows only 25 to 
30 different cipher groups because vdth the short slide the number of 
plain elements and cipher groups coincides? whereas with the long slide 
the number of resulting cipher groups increases with each new columnar 
alphabet o For instance, we get 60 different cipher groups from the five 
alphabets in Appendix I A 6 b. 

A closer study of the long slide shows that =• when the presence of 
the long slide can be surmised « the column count resulting after the 
evaluation of the parallel passages nay profitably be entered at once in 
columns of IDO cells * If these columns with the frequency entries are 
slid with respect to one another so that the entries correspond as closely 
as possible in all columns with regard to frequency of occurrence, then 
we get the figure shorn in Appendix I A 9 b where it has been possible to 
arrange that? 

1„ Frequent values generally stand on the same level vdth frequent 
values, 

2. Infrequent values generally stand on the same level vdth 
infrequent values or vdth empty cells, 

1 . ■ i 

3« Occupied cells in a column correspond as far as possible in 
position vdth occupied cells in the other column* 

Columnar alphabets derived with the long slide can therefore readily 

be reduced to one another before the individual alphabets can be solvedo 

Inasmuch as this reduction can be undertaken with great certainty even 

though there are few entries in all columns, columnar alphabets derived 

from one another with the long slide hardly afford any greater security 

than the simple monoalphabet 1c substitution, no matter how great the 

number of columnar alphabets may be, unless it happens that the entries 

for the individual alphabets do not permit this simple reduction 0 The 

possibility of reduction before solution is based on the fact that the 

cipher elements are arranged in an arlthrrotic aeouence, that is to say 
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In a sequence which is known before solution of the columnar alphabeto 
If, on the other hand, the structure of the cipher sequences is 
neither arithmetic or alphabetic, as is generally the case, when derived with 
a short slide, then a reduction of the columnar alphabets to one another 
is possible only after solution, since the arrangement of the cipher 
elements, in which a reduction is possible, can only be found when their 
plain equivalents are known,, Hence the short slide with a random 
arrangement of the cipher sequences affords increased security *. Of course 
one must not forget that even a partial solution of the columnar alphabets 
may afford possibilities of reduction.. The greater the number of columnar 
alphabets, the less may be the state of solution which renders a reduction 
possible, whereupon the gaps in one columnar alphabet may be supplied from 
other alphabets as is shown in the example in Appendix I A 9 a® 

Even though the alphabets in Appendix I A 7 b sheet 1 were taken 
from the number square by a certain route, the alphabets derived from 
one another by this method can just as well be derived by the short slide® 

Of course, the plain values must not be inscribed on the slide in alphabetic 
sequence but in a sequence obtained from the route® In the present example 
in Appendix I A 7 b we should haves 

The plain sequence of the 3lide: earbungchitkofs 

v c z 1 h m p d w j x q ® y , 

The cipher sequence of the slides 10 20 50 60 80 02 22 52 72 92 15 25 

65 75 95 06 16 56 86 18 28 68 88 98 

09 29 59 79 99 

J , ■ 

Alphabet I would, be read off by setting a against 20, alphabet EC with a 
against 52, alphabet 3 with a against, 75 etc® on the slide® 

The difference between a group of alphabets with random structure and 
one produced by the route ( Duktus) is that in the latter case the alphabets 

can be reduced even before solution if it is possible to recognize the 

* r ¥ 

route and the various starting points o 
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However It will not always be easy to infer a route from the columnar 
count of a cipher text, because with columnar alphabets the number of letters 
of an individual alphabet which occur is subject to marked accidental varia~ 
tions and the possibilities of tracing a route through a number square are 
relatively great, , 

Therefore vie recommend undertaking the columnar count in various number 
squares corresponding to the number of columns found and then marking as 
usable cells in all other number squares all cells occupied in any one 
square, as has been done in Appendix I A 9 c, It may also be worth while, 
as done on sheet 2 of the Appendix^ to designate with a ”2” the cells 

o 

heavily scored in a number square, to assign the value "l" to the sparsely 
occupied squares, and to assign a "O'* to cells not occupied in a number 
square, insofar as these cells may be used as is shown by a comparison with 
other number squares. 

Hence in each number square a starting point must be fixed and for this 
it is best to select the most heavily scored cells in the square because it 
can be assumed of these cells with the greatest probability that they can 
be reduced one to the other. If a number 8quare, as in our present example 
for alphabet II, shows two cells with equal or approximately equal scoring, 
then these two must both be considered as possible starting points o Correct 
results can only be expected if the starting cells can actually be reduced 
one to another, 

Finally every probable or possible route must be taken out of the 

individual number squares, always starting with the initial cell. As a 

comparison of all the sequences taken out on sheet 3 of the Appendix 
• ‘ ■ > 
reveals, the correct route Bhows a relatively high number of agreements 

for the values. 0, 1 and 2 in comparable columns, as well as a relatively 

low number of contradictions such as the coming together of the value 0 and -2, 

The alphabets of the table on sheet 3 of Appendix I A 8 c, on the other 

hand, cannot be produced by a slide because they change from column to 

column, due to the transposition with respect to the table on sheet 2, 
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Nevertheless even hero systematically derived alphabets are involved vhich 
can all be derived from one another vdth the aid of the transition sequence 
cjrhumdtgiyvlapsozfnqwbkxe 
This sequence is called a transition sequence because it produces the 
transition from one alphabet to the adjacent columnar alphabet* Far 


instance we get 

from the c 

of each column 

a l 3 

in the adjacent 

column 

ft fl l 

3 

ft 

fl 

ft 

" 1 r 

fl II 

ff 

ff 

II fl I 

r 

Tl 

ft 

ff 

** } h 

ff If 

ff 

ff 

it it 

h 

fl 

ff 

ft 

u 

ft ft 

ff 

" etco 


As a comparison of the sample encipherment standing under the several 
encipherment tables in Appendix I A 8 c shows, it is possible in all 
cases where there exists such a transition sequence for the derivation 
of adjacent columnar alphabets, i.e. in the tables shown on sheets 1, 2 
and 3, to identify plain text parallel passages — in spite of encipherment 
by different columnar alphabets ™ through the fact that their structure can 
be recognized by the repetition of elements standing at specific places 
within the plain text even though they can not be recognized by identical 
cipher elements. For instance, the cipher text for the plaintext word 
"Erstbeste igung” reads, if enciphered with the table on sheet Is 
starting with column ABC etc. vjjjcanndadqyg 


" " "BCD" wkkkdbooeberzh 

" " " C D E » xlllecppfcfsai 

" " ” D E F '» ymmmfdqqgdgtbj 

In positions 2, 3 and in positions 6 and ID, in positions 7 and 8 and in 
positions 9 and 11 all the cipher elements agree. The coinciding patterns 
of encipherments of the same plain text arise when enciphering vdth different 
columns if the plain text using columns progressively show certain agreements 
vdth the plain sequence which is shown in the table by the vertical 
coordinates. 

If the starting point of the several alphabets in the transition from 
one column to the next moves from the top downward as on sheet 1 of the 
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Appendix, then certain correspondences in the letter sequence between the 
plain text and the plain sequence reading from the top down cause the 
siraillarities in the cipher text just described, as is shown by a comparison 
of the plain sequence with the plain text word written below in various 
positions and also with the cipher text patterns on sheet 1 of the Appendix: 
Plain sequence: abode fghi.1klmnopQrstuvwxyzabcdefRhi.1klm 
Plain text: erstbesteigung 


erstbesteigung 


erstbesteigung 


erstbesteigung 


From this figure it is clear that similiarities in the cipher text always 
arise when the plain text and the plain sequence have the same letters at 
the same intervals.* 

Q* the other hand, if the starting points of the several alphabets in 
their transition from one column to the next move from the bottom upward 
as on sheet 2 of the Appendix, then the similiarities in the cipher text 
occur when the plain senuence read upward shows agreement with the plain 
text. 

If the starting points shift irregularly as on sheet 3 of the 
Appendix, then the plain seauence must be picked out to correspond to these 
degrees of displacement of the alphabets The starting point c of the 
transition sequence cjrhumdt etc. is in column A on a level with plain A 


B ” « n n tt S 

C 11 n « It II I 

D " » " n n X 



same interval as the plain text "Asiens Revolte «» for the letters asi, re 


and ol*,e. 


These similarities in the cipher text will be termed henceforth 
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constructively similar passages or constructive para l lel passages . 

Since these constructively similar passages agree only in their 
structure but not in the elements, they cannot be picked out in the 
usual manner oy the count. But if the letters of the constructive 
parallel passages are designated serially 01234567890 and, omitting 
the first 0, letter repeats within a length of 11 letters are designated 
by the digits below, separating by a slash the digits for repetition of 
a second letter from the first digits, the following texts when converted 
into digits would appear as follows: 


01234567890 

a kkkayywdfd 

- w ■ A 4 

znnndbbzgiv 
use jtsxntos 



7/123/56/80 

7/123/56 

7/150/48 

7A5/480 

40/379 

srssr. 

not picked out 
9/157/28 


The numerical values thus obtained can be subjected to a count and compared 
with one another. This method can be used in a corresponding way for quite 
short or quite long constructive parallel passages, since even a repetition 
of the mononte sequence 01234567890 beyond 0 does not lead to errors. 

On the other hand, if on sheet 4 of Appendix I A 8 c the columns of 
a systematic Tritheim table are transposed, the result is that the 
individual alphabets in all the columns agree and are only cyclically 
displaced, so that a transition sequence from alphabet to alphabet no 
longer exists. Consequently plain-text parallel passages can no longer 
appear as constructive parallel passages (unless it be that the columnar 
alphabets are used repeatedly in the sequence of their transposition, which 
should not occur In practice, and that at the same time the plain-text 
parallel passages coincide in structure with the plain sequence). In the 
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case of a Tritheim table like that on sheet 1 reduction of the individual 
columnar alphabets is possible even before interpretation, because the 
cipher seouences have an alphabetically like structure. 

In the case of a Tritheim table like that on sheet 2 such a reduction 
of the columnar alphabets according to the principle of the short slide is 
possible only after interpretation. 

In the case of a Tritheim table like that on sheet 3, on the other 
hand, a reduction of the columnar alphabets according to the principle of 
the short slide is not possible, even after interpretation, because the 
single alphabets cannot be slid in respect to one another due to the trans~ 
position of the rows. 

In all three cases, however, i c e c always if a transition sequence for the 
derivation of adjacent alphabets is present, the constructively sjmilar 
passages afford another possibility of reducing the columns before 
int erpr etat ion , 

Since the cipher values of two constructive parallel passages have 
the same interval in the transition sequence as do the columnar alphabets 
employed for encipherment, it is possible to draw inferences from the 
position of the constructive parallel passage within the cipher text 
written out in 26 columns regarding the interval of the corresponding 
cipher elements of the constructive parallel passage in the transition 
sequence. If constructive parallel passages are present to a sufficient 
degree, it should be possible to reconstruct the transition sequence by 
their evaluation. 

How this is done has been shown in Appendix I A 9 d with a plain text 
example of 180 elements. The plain text on sheet 1 was enciphered using 
the table on sheet 3 of Appendix I A 8 c. The resulting cipher text 
has been subjected to a count shown in a 26 column table on sheet 2 
Appendix I A 9 d. At the bottom of sheet 2 Appendix I A 9 d all the 
constructive parallel passages in a length of 11 letters have been 
located consistently and these have then been marked in the cipher text, 

114 


T OP SECRET 


Doc ID: 6592461 


TOP SECRET 




Oi sheet 3 of the Appendix we have first evaluated the three 
constructive parallel passages vdth the hi^xest ratios between length 
of the parallel passage and the number of cipher elements which run 
parallel, namely the ratios 15 s 13, 14 : ID and 9x7, corresponding to 
our knowledge of the fact that the columnar interval of the constructive 
parallel passages reflects the interval in the transition sequsnce of the 
letters which run parallel 0 The resulting intervals between letters taken 
two at a time have been entered on sheet 3 of the Appendix in the vertical 
column a to z over against the two letters . Insofar as overlappings 
occurred, they have been entered on one line. 

The attempt to use constructive parallel passages with less favorable 
ratios led in part to contradictions with the already obtained results, 
a sign that these constructive parallel passages are not genuine parallel 
passages. Qi the other hand an attempt was made successfully to stuefr the 
elements preceding or following the already evaluated parallel passages to 
see whether they might also belong to the genuine repetitions in the plain 
text* Using all possibilities we get at least the two partial sequences 


cj.hu.d.gi.v..p. * z f * * . b k 


o 


* . . y • 1 a , *o. « n q w * *x. 


which can be united to form one sequence without contradiction at only 
one point* The sequence runs as follows: 

cjrhu.d.giyvlap.ozfnqwbkx and embraces 22 of 
the 26 letters® 

<7ith the aid of this transition seouence it is possible to determine in 

the 26 column score on sheet 2 which cipher entries correspond to a particular 

plain letter. To explain this fact we have entered the number sequence 1 to 

* 

26 at the upper margin of sheet U to Appendix I A 9 d and beneath this the 
transition sequence just reconstructed (repeated)**. Cta sheet 5 is shown 

^ This sequence 1 to 26 does not appear. 

** Not actually repeated* 
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the decipherment table corresponding to the encipherment table in 
Appendix I A 8 c sheet 3 which was used in the present example but only 
for the two plain letters a and p. If sheet 4 is placed on sheet 5 
so that the upper edge of sheet 4 is beneath Row \a \ of sheet 5 and the 
digit (T) is under the column designation »Xj i.e, as follows: 

Sheet 5 to A;pendix I A 9 d 

gBC DEFGHUKlieiOPORSTUVWXTZ 

A pa 

d£2345678901234567890123456 Sheet 4 to Appendix I A 9 d 

c jrhu 0 d 0 giyvlapozfhqwbkx 0 cjrhu o d o giyvlap* ozf nqwbkx 


then in this position plain a results from the coordinates cipher ;Al 
in column lN£ , designated by a of the transition sequence 0 If sheet 4 
is dropped one row on sheet 5, the letter b of the transition sequence 
indicates column [wj on sheet 5 as the column in which plain a corresponds 
to cipher ! Bp. In the next position plain a is then obtained from cipher \ 
and transition value c as indicator for column |a^ By moving sheet 4 
with a definite setting, let us say fl/ on column jjAj we can get all plain 
values a as the result of the coordinates 

Cipher A and transition sequence value a 
n B ” » «» »» b 

n (j n rt n « c 

If sheet 4 is now laid on the count on sheet 2, Appendix I A 9 d, which has 
the same coordinates as the decipherment table, and is shifted in analogous 
fashion, then the scores corresponding to any particular plain value will 
be found in all the columns:, 

The scores taken out in the 26 different rows when sliding sheet 4 
on the count square have been entered in the first line beneath the trans- 
ition sequence on sheet 4 in such fashion that the count from Row A stands 
beneath a of the transition sequence, the count of Row B beneath b of 
the transition sequence, the count of Row C beneath c of the transition 
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sequence, etc * The following rows of the consolidated counts have been 
produced in the same fashion save that for the second row the 2 was set 
against column A of the count square, for the third row the 3 of the top 
sequence on sheet 4* 

Moreover it does not matter in what position the upper number sequence 
on sheet 4 stands with regard to the transition sequence beneath it because 
the final result is independent of this setting* 

At the right of sheet 4 the scores of each now, i«e* the scores cor- 
responding in each case to a particular plain value, have been added* 

These numbers yield a normal alphabet distribution so that a complete 
solution of tiie cipher text can now be achieved readily* 

This proves that the constructive parallel passages in the cipher text 
permit of the reduction of all the columnar alphabets to a single alphabet 
even before interpretation* 

To recapitulate, we may say that all the systematic relations between 
the columnar alphabets sooner or later afford a possibility for reducing 
the columnar alphabets, whether it be before interpretation due to 

1* Derivation of tho columnar alphabets according to the principle 
of the long slide, 

2* Derivation of the alphabets according to the principle of the short 
slide in connection with a systematic characteristic of a cipher 
sequence which permits recognition of the sequence of cipher 
elements on the slide even before tho cipher alphabets are 
interpreted, for instance in case of an alphabetic arrangement 
of the cipher sequence for monoliteral substitutions, of an 
arithmetic arrangement of the cipher sequence in case of number 
substitutions, or in the derivation from a number square by a 
recognizable route, 

3« Derivation of columnar alphabets by means of a transition sequence 

in connection with a regularly progressing use of the columnar alphabets} 
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or be after interpretation or after partial interpretation due to 

1« Derivation of the columnar alphabets according to the principle of 
the short slide in connection v/ith a cipher sequence which is 
random or whose systematic character can only be recognised after 
interpretation; or 

2. Other systematic characteristics which may vary according to the 

1 

system o 

On the other hand* if it is possible to avoid the dangers entailed by 
any systematic feature in the structure of the individual columnar alphabet , 
in its derivation from other columnar alphabets or in the sequence in which 
the alphabets aro employed, i,e a if all the weaknesses of polyalphabetic 
substitution revealed in the foregoing studies can be avoided, then poly~ 
alphabetic substitution can achieve a degree of security which is greater 
than any other basic system affords o Vflien properly used and when all 
security measures are observed, polyalphabetic substitutions can assure 
complete security for any amount of traffic » 
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Alphabets I 

* JI 
/- if 


Or dr /C. ^ ** £_ ^ ^ ^ Z 1 ^- '*' 4 ~t ■**’ V 3 ®Q 


*V • ■ zuxu^- &// • • IxiyXbMli • Hiyrt '‘loyty ■ » *g • • 
% • /J&OytflyifciSJi 7t • $/# y • • • *-^ • • # * ^ 

ifl tfd/ttet to?/ yi 9 y% rj 1 it • > • Kz+sm& • * 4 . 1 srazAi 


From the above can, be formed the following fraanents of the transiting sequencee 
between the alphabets: TT^* " ^ 



*/ -O— # 

W* - £3 




2/- Mj~ 


A 

/•C 

£ 


J2 — C? — 

W-9r 

(rz. — i’A • 
ra - sp- 
95 -^3 
rf> - rz~ 


iL- :y 
' 72) "/i , 1 
n - u 
H 


lY 

--/ - rt -@-©- 


r + 3 . 


3 4- 


c 

,6 


9 

/* 


H -K-rs 

GL -it 

CTD ~ £ / - yl) - 
2X ~ kt 

©--2i 


- A - 
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Fragment 1 a shea institution values 62 and£> 3 

</ ^/y * * - — — — , „ c~ 

/*- a. f+Y ; 


4^4, 

y /Q, • 

05 

ft 

U 

Vi 

2* 

3/ M 

a 

u, 

M iy 

V 

w 

1/ 1 

rj *r 

X3 

• fb lAs l 

* / c : 

' / <t; 

tfj 

ft 


tYZtbt 

U, 

*f *r 

C 3/ 

n 

¥* 

$3 

^3 

** 

55 Vi 


» cr 

ft *2 fr~ZFZti*& ft /U ** ^ 


y 



BJ 

ft 

n, it u 

bS 

i3/^ ^ 3/ *h)1f9 V3 

» * « ® « v* 




6 * « « 


ft 

5T 



r .Beque^ce 


Ox. 
2 . 


*s&m 


Jk 

Tf 


19 

r et *44 f '(filZuZ ■ $ 4 ± 

• y //A I'Lor/t. • Ojirt_c ** • ^ f r“ 

^ A hA<S^v(e»o **&*■ ■ ■/• ' ® f?'-"'®' 1 ' • -? ^ 


^ j V i't > ® lffl\ 

M i i V- r' 4 !-<£> /» 

0 A L l * > t t-® 

0 A L i * r 

b >G) ^ 

OA t l > ru ¥(D 

Original arrangement of: 

♦ *«. -- ^ ***/ 13 a ® 

TZTZZai *»«»««»» **«„*»«*»*■***»»»*”•**» 


I A 9 a - 2 


- ^ — 
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Original slide 

dip 


^ a, 4 c d, e. 4 * A a> * ' k, ///**** r psi 

<t, o) czo\ <rv fir'd cm enWf'M/* Sr/r/tft- 


Cipher sequence 


7^/0 £a£ 'IT'V X- 


t 


£d,ab 


Substitute slide: According to the interval which adjacent values on the substitute 

/ slide have on the original slide, the following sub- 
' stitute slides have been derived. 


r 




'/sy*Jsi/C4*-S~ .’ The values on the original slide are: 



T 



4 . C /£ * /i A A. 'fif A £> ^ 

Cl fi> crc?' t9/u /i /r<0 A1-* %-■#• 

4- dL A A^ A Z'H/h, Y* t/'V’cL 2 <& 
C2 CYCb rty° AL/r'/b/*-****^ # 


*£> 3S<^// /•'"*— '-4^ 

as part I, and 



3 ; 

Interval 3 

Interval 4 


Q, Jl A % A /Jr ^ ^ ^ 4 A Z & • / **' & <A A" £ A* ^ ^ Z 2~ 

01 OYVl'/ic/iAbrt2i.2s<40h h fiS/li/r/lt *1 -a,** *t 0r*t *t Jr <4> 


2 £, /O'** 

of or rtf) A 1 4 




/4A 1 *V 'T'fi* 
tnhAO Ar AttZsAL 


= ’ttt ^ 


Ob OAfA AWl si-Af 


<&Z If 

oycg/iLAb^-^^ 


S\ 


to Ab/h, oC £ /C a, A*m'M, / cj 4rZ t d c, '„■*•£. 

&! *4 $$(%/& /?j£28G&os&4J^QZtfa&J<b*&4'+fyJSSrJj'fL 


/i4^u 6 ; 


A, O' Mv A * c Z A Zo Of 

Oi ft ft as -k oi tnAczt -if fcfA *r*i 


« Klil/I 


k-h^fc Ar JL/fsW'At j'Ji'T'X, 
<r<,OtAt204>OYAt>/(,4i,lt ClcfOfi-'i 


f itJA 


JM^j, f \ 


rtZZ -&M iZZ ' %fa< -Mi 


MM/y : *7r **»' ti’&i 1% ‘tHi %%4HAt 

I A 9 a - 3 

-5 — 
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svir*v cfe, 

(]pr\, tuSj ^ < 2 -*-^ 

t£<C C&s Ct^ZZ, C&~S^ 

j (- Jt j 4 / Ij. y j y . Relation of the length of the original slide 

&S C^G/yt-xZvfrK-vS A^HAzf- . and the interval on the original slide of 

determines the number of parts making up^^su^tifu^e 0 ^!^!. 81113311 ^^ slide 


-tf — 

122 


fc* Vr ' 

Len^&h of original slide 

fY*St£~ 

si ide of elemen 1 

s SsstSfiSS 1 ^^ 

■^2 , 4 , , f. 

•2 * £L-j^i 


it -0 ^ * 

3 - 0 • $ 

A ~ 0 

2 * • PTJn 1 . > 

k - J^LlAzzAlI 

* * £E3L-i 

^ 2, 

S' * /I • «S 


^ • i] • ^ ? 

* *( 63 - 3 

^ * 23 / 

*■ 0 ^ '15^ 

> - g £2 

7 - •y. g.7 

•^€ » ^ .|^ • >^i 

-\/i ' £ ' y~ : 

A * PAii 

-- r. r.U 

t - *- • 4 • W 

/* - a/ 

•»*• * @- «■•// 

s' * A , J 

S' » /t i&t 

w?£ -*■ jsj * S’ • /l 

/^ - ^.s 

v> - // .{X7 


I A 9 a -4 
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TOT 


00 . . 

• 


01 . . 

a 

» 

02 .U. 

• 

03 . . 

• 


04 . . 

• 


05 . . 

• 


06 . . 

* 


07 . . 

• 


08 . . 

• 


09 . . 

• 


10 . . 

• 


11 Ji. 

• 

1 

12 . . 

• 


13 . . 

9> 


14 . . 

• 


15 . . 

• 


16 . . 

• 


17 y/. 

* 

*k\ 

18 . . 

• 


19 . . 

9 


20 . . 

• 


21 . . 

m 


22 . . 

m 


23 . . 

• 


24 . . 

• 


25 . . 

m 

t 

26 . . 

• 


27 . . 

• 


28 

• 

% 

29 . . 

• 

i 

30 

• 

31 . . 

• 


32 ./ . 

• 

£ i 

33 . . 

• 

j 

34 J . 

• 

£*• , 

35 . . 

• 


36 . . 

• 


37 . . 

• 


38 . . 

* 


39 . . 

• 


40 . . 

• 


a . . 

• 


42 Jft. 

• 

1 

43 . . 

• 


44 • • 

* 


45 . . 

« 


46 . . 

© 


47 . . 

• 


48 . . 

• 


49 . . 

• 


50 . . 

m 


51 . . 

• 


52 . . 

• 


53 . . 

• 


54 . . 

• 


55 . . 

• 


56 . . 

o 

! 

r 

5 

i 

i 

! 

57 . . 

• 

58 . . 

o 

59 . . 

• 

60 . . 

• 

61 . . 

• 


, a 

• 

Ill 

13 . . 



r 48 . . 

■ 14 . . 



, 49 . . 

15 . . 



. 50 . . 

16 . . 



51 . . 

17 . . 



, 52 . . 

, 18 . . 



53 . . 

19 . . 



. 54 . . 

, 20 . . 



, 55 . . 

, 21 . . 



. 56 . . 

, 22 . . 



. 57 . . 

. 23 . . 



. 58 . . 

,24 . 

• . 


59 J . 

f 25 . . 



, 60 . . 

26 . . 



, 61 . . 

f 27 . . 



62 y. 

. 28 . . 



63 . . 

, 29 . . 

• 


64 . . 

, 30 M 

. 

• 

65 

j 31 . . 

• « 


66 . . 

, 32 . . 



67 . . 

, 33 . . 

♦ , . 


68 . . 

. 34 J . 



69 . . 

35 . . 

• 4 


70 . . 

, 36 . . 


« 

71 . . 

37 . . 

0 < 


72 . . 

38 . 

• d 

< 

73 . . 

J 39 . 

. : ! 

t 

74 J . 

| 40 . . 



75 . . 

! a y. 

• '>* 

: J 

76 y . 

J 42 . . 



77 . . 

J 43 i#J 

44 . . 

45 . . 


* 

4 

78 W 

79 . . 

# » J 


so y . 

I 46 . . 

; I 


81 . . 

! 47 

• f 


82 .0. 

48 . . 


83 . . 

49 . . 

. 


84 . . 

50 . . 

• t 

< 

85 . . 

51 . . 

. 


86 . . 

52 . . 

• f 


87 . . 

53 • . 

1 

# I 


88 . . 

54 . . 

s 

• 1 

*1 

• I 

* I 

• ,f 

♦ • 'i 


89 . . 

55 


90 /. 

56 . . 


91 . . 

57 . . 


92 . . 

58 . . 

59 JL 


93 . , 

94 M 

60 . . 

. 4 

95 . . 

I 61 . . 

* 1 

* 1 

* i 

‘ \ 

* 1 

* 1 

* 1 

* t 

* 1 

• If 


96 . . 

} 62 . . 

< 

97 . . 

63 . . 


98 . . 

64 . . 


99 . . 

J 65 . . 


00 . . 

! 66 . . 


01 . . 

67 . . 


02 . . 

J 68 . . 


03 . . 

69 . . 


04 . . 

* 70 . . 

< 

05 . . 

} 71 . . 

• 

! 

I 

1 

? 

06 • • 

72 . . 

* K 

; 1 

07 . . 

73 . • 

08 . . 

74 . . 

09 . . 


S ECRET 

rs# 


(continued on next aheet) 
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9 a 
o q 


7 1 
13 r 


2D i 

16 g 


2 v 


6 d 


3 w 


13 h 


0 'jc 


Reduction of the five alphabets from Appendix I A 8 b 
by sliding the values entered on strips vdth 100 cells 
until matching is achievedo 


s 

l 

© 

U 


I A 9 b 
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The four alphabet^^ 


phabe 

1 f $ 4- sCfl' ^ l »*y>v stCar^Z- 


I A 7 b 


%*GG) 


>et 


r 

r 

nr 

JC 



M'btr & a btsrtrn }% izrtjrzi s}s$ 

^ ***** *" »r ^ «r 5 / svtzsi t&srzg is&rtrrtitri^ 

rrA n/z sr^r ot ttJ<rj%j<. rt jr ±v~jb (nzjsrzsMk r$ *&j£- 

j “ji fey ryrHj tU~ A hf:^rr1ticrf-<Z2,i~irZ52c?l Zl 


J* Is- 

r i' i • 

- 4 * 

« 

N' 17* 

v 

; ^ 


PJ 

§JK 

l , 


1 i 

«| 

©£ 


1 ! 

■r^ r 4 

I 

i 


fe *P 

V Li 

" &• 


£ I 

£J f 

K 


© 

e • 

1 & 


*? te 

&*? 

e 


V 


i j 


* V A ,J 

d*ra-J fn*An*JieM pw^rtc^ 

by a specific route (not marked) by inserting the plain sequence. 

£ dr J^xT L rjA or <. £ £, A. ^ jul <* j Q j^Q 

j*y4£a~'Jc^' kjC ^0 rCi^o r^-TA / - X*5 Vf^a&v^- 

^it./f, a i/ /lvM± rr, ?rr%n 


62 JT | 

C \ ~ * / ? * * £ * 


& -HL 


4rlL 


t j &. i rrrrr 3 


C /t o i >r !"*/-<?£ 
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'/ e 2&>Z Atj .VJ^ ■ — - ig 


ts&Tftafo ^ ^ph.b.uT™' ». 7r<tcT^ r^a,: 



/ ^r*_^2~^ ^2_ ^^&*2222^^^cf2. // *^ ^ ^ S2e^*» ‘(ah^^^-»2^A 

6utZ, dc-/- ^uz^tc*, x, — /*». 


^/ftt^Z-rr^-, &*^Ak*c^jC*Z~ <=- ^'-•C-^L-w' sb Z/^At-ZT} 

, ^ ^ ~jrrr^~ V !- :il i S °u2 h fu ciphe r text there is a possibility Of 

s ft^«fe?2fi re s o ?Sr i r fro " a count 

J2^<y -4 >4 & it*> 22 A 1--2 />-^,>f / _ 

As2^r>A2t, ; 


count of the 




The count for the ci 

Tf 

pher^ext i] 

n I A 7 b is 

|£ 1 

*r 

? : 


** 

mi 

PH 0/ 0 

3ft *- 

/ 

n 

/ n 

*fHL 

it 

*rr 

i 

I 0/ 

if 

1* / 

It 

/ 

j/ 

/ 

ff 

Off 

H 

/ 

m 

m 

at 

a 

" 0/ 

n 

/ im 

i*- 

i 

ft 

1 

— m 

« 

m / 

m* 

pi 

iff I 

0 ay 

la} / 

m 

» TT 

1 

tm 

*n~' 

ML 

" at n 


d.Hsa+2* 

flr2/d, £h> 

2-2A2£* $s3*z^s' 

2fis 




/w4^. 


-t 






/**-v^ /k&jjfc 2ZA&-r (2 s>x2v-<lJL "Je&AeLy ^^y/// 


l\ 


would 2^2a^ t o^rec§fznPzc ^ifi^u^iie A22~%- 
one c elI. t of2pne alrmhet in the cgrresppndi 
a^oi - e ^ e 11 JM Os»-*y h-a Xo ^ M firt w r., Lnnfw l 

ocr o o jLi a 4 , 




(TO- (r 


A 

A 


a 0 ' a A 

4 cr A^ 

(? tfjj 


0 ^ 


£ ' 
' 4 


// 

// 


tecognit i«n . is f ac lTItatedJby markingVall' ^corss. 
r n 6i FEH 3 h?fh^ogfffi$»^fo a ^^ : ma-^cell with 


A 


* r 


-o 

* 

~1F 

A 

A 


AO 

A 



O'/ 

<r 

O' 

cr 

2Z 

A 

A 

A 

cr 

O' 

+T,* 

0 

A 

A 

O' 

<1 

O' 

O' 


A 

cr 

O' 

O' 

r 

A 


A 

A 

A 


(rcr 


A 

cr 

A 0 


O' 


O' ^ 

o-<r o* 

<r //0t 


0- 4 

<r 0\ 

0 * m'’^ 

cr Q 
// X/ 


* x 


l!/jf 
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Assuming that the route 
e^h alphabet (Alphabet 


alphabet „ — . r — - _ 


as down the coll 
I has like 


umns and taking the large^^s core $s starting 


aA A^> (+Z tsA, 

cm*/* m<r<rc'/tturmirrrrvu trurflo of] 

\2\A a a\a]aA 2A <r\o'\p]0’//A UlViniwjrtrW 



n /f \/> yi /I oO /» ^ I*' p I* / / '■ •VM' * 1 ~ r " * 

a /* r <r(r tr a a A 2 o tr tr tr tr tr r z A 2 a A 
a zIaia a 02 irlirb-y 1 irnt-uyi tn°-f\A a\<A 
\o\tr\ tr o troldj roum trA\t j 


a ojl tr\tr\ 
\r/t O' A A 


fy'wdA (As+~ <: 'tLcr^e^ / Ac /4c A.ArC^' 

If we ccmpare (this with the sequences resulting from other assumptions: 

l) Assuming the route runs from left to right by rows: 

Sr _£ f3L» 2 O^tTr A A O' O' O' / A O' A A O' A / A trArAAtTlTir Z 0- ir 

tic. -S’# izo'ao'aa a o' a itzaz trz tr a a o' O' o- a a tr/i a a tr 

t- JT]* 2s O' A O' A A A CAOZAZO/CO a 0 OOjAOAA/IOZ 
C 2 A OA O' A A A A OA O' A O' O’ A A ?A tr O’ 0-2,2 O' O’ Z O’ O' 

// W" 10 a A a ^ rtr ^ rr or A a rA r a a o-^rrr trtr z A O' 


; <&*>4*C. /vw *w*.0r-iri4 -oi,oz -12 Z^r. 

2) Assuming the route is serpentined 00-90; 91-01; 02-92; etc# 

Sr Z t\- lA a A/1 2 A * a A <TA O' O' O' tr tr tr tr tro- A A <T O' 0/1 0 O' 

jr A t 1 . i/I /AA^AAAAZ^O’O'trtrO'ZAAAO'O'O'OO'tr 

“V Ej » 0 / / a a 2 a o' tr tr tr rz a a a tr tr tr tr tr tr i A z a t / *aa 
nr j, » j^o'a O’O'^AAZAAAOrtrtrZtrAo'fO'A / o O' o A O' a 
jf j}= *a a zz (firz/A o' A o ' a a o-r/ trtrtrtr o-tro-tr tr a o- 


~ hZf^. n-ir,i 2 -*.,'r-*s;u-ot~r. 

3) Assiiming a serpentine line in the scored columns 00-90 ; 92-02; 05-95, 96-06j etc. 

3; . z /j J A j A A A 2 trrtr/t o tr r O' y tr O' a a O' tr 0 A r O' 

j* z - ZO'A AO 2 A A a a 2 tr tr tro- A A / A 2 0 o-cr tr O’ tr A ^A 

TTt* z - zaaSzaaaa tr tr 0- O’ o 2 A A A trot/tro-AZAZ o-/\ 

& z ~ J A tr A z trtr A 2 A A A tr trtr •rtr a oo tr A / tr tro- A a o- 

,7 L - 2A a ZZ tor ±A A M otrAAtrtrotrtrA rotrtr tr A tr 


A 

cS-> 


jtuer £ /t* 

then we may regard Ahis route for alphabets 


labets I, Ila, III and IV as correct. 
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Plain text 


r Ox A rr£, r L * ^ ^ or £> c aS 


AH IEFGH 13 KLMU 0 ?a 7 <S>TlSVWXyZ. 
d, i> & a f o r £ & fc /r & ^ > v & ^ +• iStf * 4/4 /d\ 


o C * ^ MZh (T *>r *' & 


L 


t 


r c d. d £. 4 

/> l * A c £. s'sC >- tr l <r/£V r ^ <- *■ -r *- ^ £ <*>. n. 


*'£,$*, e. r- ^ f t *'**-*-« c 


JL 


t 


£* 4 (/ (/ m 


/ 


A. *■ 


stev-€.£,r4ifcc -t ‘ /. c Q'P' J T- 


4. / £y ^ A. *.'4 <^T A /L £ A. £. £* <+■£■ 'T- d* £. +t x. 


<y 

A 

G> 

d 

Jt 

i 


/sir'iWu^/tr 

180 elements 


* x* ITA&'C $ J 

Cipher text : (enciphering table in Appendix 1 A 8 c page 3) 

*v & </ ^ ^ ‘T'K k, &k.d k. 6 j, J <v- V v- CT <r ^ 


b j. jy r Q'' > *'/O'0 r ^t/ h ^ a M.A/* ^ A. / 

I — —r ~. — 1 — :.— - v* - . Jf mm * 

* * T^ 

fo't'fc./ tr'V/C, /f 'A sC/rA L dy A> /*" i' ^ ffi. ^ ^d. '*'4,d q i i p r /. /t A e 


. £>V. 

* t A 
y^.iu 
A'R . a /. 
dto . *:>. 
A.V-/V 


<Xy 


Gs 


j. ^ i p,ir P'jv a'/e. i ^ A #7t/ c/K<.fuk 

a 

£. #K <, y /l 1/ ^ & & /C, ,c. Ay £ 

, j A d, d & £, <s Q A /*v fiyftrk- **r>r & c, *C 4, & 


<y <. /C ^ ArAvv/ (t ^ A X/ A /V fciye. ^ 3L +*0. 

‘-J -1 L '<£• 4 


Constructive parallei^pas sases yy ivigth Vf^oU ^y- 




or 4v^; * j. t r l t>± 

A -!r -$* 

v A m o 


j>r 

3 

yf . 


- /I - 
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* 


'V /v* ^ ^ ^ 
& 


£y G+ 


6 

* L }■ A ^ 


A 5 j'-/ ^ A (L k *£ 
6 * * a. 


/t c 'C. *j Dfi>*. Id* 


1 


Number of constru 
tive agreements. 


z/4 ^ 

3 

//^ ^ 

A- ✓ 

3 

1 A 9 d - 1 
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Evaluation of constn^^e parallel passages 


M 


AB cveFCiH i i illmV0p vv*x y z 


* fa *\ to'k'rzfr 4 i &. 
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10® Periodic polyalphabetic substitution with selective encipherment ® 
( Spaltenc&sar mlt Vkhlverzifferung .) 

An interesting variant of the polyalphabetic substitution, and one 
which introduced something completely nex 7 , was the so-called American 
Strip System® The innovation is found in the possibility of being able 
to choose the cipher text fk*om among 25 different possibilities , This 
opened up an opportunity of using a definite secmence of columnar 
alphabets far more frequently than hitherto without endangering security® 

The new idea is that a series of random alphabets inscribed on strips, 
slides or wheels represent the columnar alphabets® From these columnar 
alphabets a fixed number is put together each time in a pre-arranged 
sequence and the plain text to be enciphered is set against a definite row® 
Any of the other rows may now be Selected as cipher text® If, in decipher- 
ing, this cipher text is set on the same row level with the Hke columnar 
alphabets, then one of the remaining 25 rows must yield plain texto 

In this system the row may be divided one or more times so that for a 
one row plain text setting two half rows or three one-third rows of cipher 
text may be selected® 

Appendix I A ID gives an example of this method® The alphabets at the 
left are put together in the middle according to a key number agreed upon 
in advance or given in an indicator group and the plain text has been set 
for the top row® For encipherment half rows on the level of rows ID and 19 
have been selected. Upon setting this cipher text at the row level on the 
ri^it side of the Appendix the corresponding half rows 16 and 7 yield the 
plain text® 

-ben using random alphabets which cannot be reduced this method permits 
the use of a sequence of columnar alphabets, hence of a particular setting, 
as long as none of the 25 possibilities of encipherment has been used to such 
an extent that the intercepted cipher traffic permits solution as a poly- 
alphabetic substitution. This condition requires the full and equal 
utilization of the possibilities involved in the system and a check in this 
regard can hardly be exercised successfully hence we must not lose sight of 
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the fact that under these conditions the limitation of a specific sequence 
of columns to a definite amount of traffic is extremely difficult. Further- 
more, the permissible amount of traffic depends to a high degree on whether 
the plain text uses stereotyped telegram beginnings or is In general of a 
stereotyped character or not, e.g„ whether publication of part of the content 
entails a risk that all traffic in the same key will be capable of solution. 

The question of security of columnar transpositions will have to be 
investigated further in connection with the study of cipher machines. 
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As already mentioned in connection with poly alphabetic substitutions there 
existed for the further development of cryptographic work the possibility of 
extending the use of variants and the introduction of syllables already 
encountered in the syllable substitution so that instead of systems with 
one or two letters or digits more would be employed* 

For these 3, 4 and 5-*place systems the name bode has been introduced 
although there is no basic difference between the substitution alphabet and 
the code but merely one of degree* Both in the code and in the substitution 
the individual elements of the plain language are replaced by cipher elements 
in the sequence natural to the language. In the substitution the individual 
letters and digraphs and even syllables and articles are provided with cipher 
elements while in the code substitute values are provided for the single 
letters, digraphs and trigraphs as so-called spelling groups but also for 
words, groups of words or phrases and sentences, and likewise for place 
* names and personal names* - 

These extensive codes aim both to increase the security of this 
cryptographic system as far as possible and also to reduce the length of 

i 

the cipher text in comparison to that of the plain text as greatly as 
possible and thus save on telegraph and cable charges* 

The size of codes varies greatly according to their structure and 
the number of places in the code groups* If number codes are used we may 
get with 


3-digit groups 

10 3 = 

1000 groups 

4-digit groups 

ID 4 ■» 

10,000 groups 

5»digit groups 

10 5 ® 

100,000 groups 


Any greater number of places is not usual because with 100,000 groups we 
already have a very extensive cods book of some 1,000 pages which is 
capable of meeting all demands* the other hand, when letter codes 
are involved the theoretical size, using the 26 letter alphabet, is for 
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g 

3- letter groups - 26 «*'. 17,576 

4- letter groups 26^ « 456,976 

C 

5- letter groups 26 «= 11,881,376 groups. 

, It is hardly necessary to mention, the fact that the theoretical limit is 

virtually never used in the case of 4- and 5-l©tter codes o 

The groups of these letter codes often show a systematic structure 
which on the one hand reduces the number of possible groups and on the 
other hand affords certain advantages in that the groups are pronounceable 
or that in case of errors in composition or transmission the proper group 
can be reconstructed more readily so that inquiries may be avoided in case 
of slight garbles in the encoded text (e.g B when sent by radio) without 
running the risk of a false reconstruction which might give rise to mis- 
understandings or errors® 

To secure pronounceable groups, it is well to observe a definite 

alternation of vowels and consonants within the group 0 If we designate 

the vowels by v and the consonants by c and note the number of 
different vowels or consonants which can occur at a given position within 
the group, we get, for instance, the following possibilities* 

1® c v c v or - v c v c 

20 5 20 5 5 20 5 20 e a 4-letter code ivith 100 pages 

each with IDO lines which is 

equal to a 4-digit code of 

10,000 groups 

2. c v c v 

20 6 20 6(y counts as 6th vowel) 

, <° a 4:;l©tter code with 120 

pages each with 120 lines 

and a total of 14,400 groups 0 
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c 
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20 5 
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v 

5 

c 

20 


*= a 4— letter coda of 200 pa ges each with 
200 lines and a total of A0 ,000 groups. 


j ea a 5-letter code of 500 pages each with 
100 lines or a total of 50,000 groups <> 


5« v c 
5 20 




c 

20 


v 

5 


» a 5-letter code of 500 pages each with 200 


v e lines or a total of 100,000 groups 
5 20 ' 


6 0 c v c v. c 

20 5 20 5 20 


or 


c 

20 


5 20 20 


v 

5 


op • c 
20 


V c 
5 20 


V C 
5 20 

® a 5-letter code rath- 2,000 pages of 100 or of 

c v 200 lines making a total of 200,000 or 400,000 
20 5 

groups o 


In this way 4— and 5— place codes of any size and for any purpose can be 
produced*, 

On the other hand the systematic feature of the group structure may 
consist in associating the numerical values to the individual letters of 
which the group is composed and constructing the groups so that their 
cross sums always give a definite value ? Since in this case one element 
in ttea group serves as control element, which is of necessity the complement 
to the cross sum of the other elements, such a 4— place system would only 

have .^ho extent of a 3-place code and a 5-ixLaco only the extent of a 4-place 
code 0 

The simplest method of doing this would be to equate a « 1 ( b = 2, 
e « 3 ooo z * 26 and have the cross am of the group always 26, in wh ich 
case sums over 26 would again start with one, Ther 8 for example, with a 
4 -letter code the following group formations would be possible: 
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aaaw * 01 01 01 23 « 26 abav «= 01 02 01 22 « 26 , 

aabv - 01 01 02 22 * 26 abbu « 01 02 02 21 * 26 

aacu = 01 01 03 21 * 26 coo 

o ft o o O 0 ft ft 

ft ft O ft ft « O o 

o.oo ; • abzw ® 01 02 26 23 * 26 

aawa « 01 01 23 01 <* 26 

aaxz .;<= 01 01 24 26 « 26 

aayy ® 01 01 25 25 » 26 

aazx ® 01 01 26 24 »* 26 

If the transriittec* group should then read g h o s instead of the correct 
group g h r s « 07 08 18 19 « 26, then no such group would exist in the 
code because the cross sum 07 08 15 19 ® 23® Assuming that only one 
mistake is.to.be found in the group, the correct group could reads 
j h o s ®!3 08 15 19 - 26 
gkos« 07© 15 19 «* 26 
g h r s » 07 08(l8jl9 “ 26 or 
g h o v - 07 08 15(22/ “ 26 

Assuming always that there is only one garble in the transmission of the 
erroneous group, the cross sum will essentially limit the number of possible 
correct groups® Without the control letter the group would have -teen 3”Place 
and would have read ghr or g h oj in this case instead of 4 groups we 
should have to select Jfrom 26 + 26 + 25 « 77 possibilities® 

On the other hand if a transmission error consists in the transposition 
of two elements of the group, for instance if the correct group gh r s 
is transmitted as h g r s, then the control letter fails of its purpose 
since the cross sum is the same in both cases® 

However the group structure can be arranged so that the control values 
will also indicate transposition of correct elements within the group® In 
this case it is necessary that the letters have different values according 
to their positions within the group® On the top of sheet 1 of Appendix I A 11 a 
is a sample table where the value of a letter in the first position of the 
group is doubled in the second position, trebled in the third position, 
quadrupled in the fourth position and quintupled in the fifth position, 
beginning with 1 again whenever 29 is exceeded® 
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To round out the system, rows I, II, III, IV and V for the sotting 
of a letter in the 1, 2, 3, 4# and 5th position within the group have 
been extended 3 values beyond z « Consequently the prescribed cross; 
sum of the groups is 29 0 

If the transmitted group reads, for example, c 1 s b v - 

03 24 28 08 23 « 28, instead of the correct group d 1 s b v ® 

04 24 28 08 23 e 29, then assuming that only one element is false, 

the correct group can only reads 

d 1 s b v “fop 24 28 08 23 - 29 or 

c 1 s x v « 03 24 28j09j 23 - 29o 

In this case no other potentially correct groups can be formed because 
in the second, third, and fifth positions of the group no letters can be 
found with a value one greater than that of the transmitted lettero 

If the table is arranged not according to letters but according to 
numerical values, i»e<. if it appears in the form shown at the bottom of 
sheet 1 of the Appendix, then those values can be read off which /nay be 
used to replace a garbled value 0 

In the above example where the transmitted group cl’s b? showed 
the cross sum 28 it would be necessary to replace one element at a time 
by another with a value greater by one so that the group will attain 
the correct cross sum 29o From the table we get for the first element 
"c" from row I "d n , for the second element «1" from row II a — „ 

For the third element "s” in row HI a <=, for the fourth element "b" 
in row IV an M x" and for the fifth element "v” from row V a '-y 
Hence the correct group could be d 1 s b v or c 1 s x v 0 

If the transmission error consists in the transposition of two • 
adjacent elements, for instance if instead of d 1 s b v the group 
1 d s b v is transmitted, this error is likewise revealed by the cross.: 

r 

sumo While the cross ;sum of d 1 s b v » 04 24 28 08 23 « 29, the cross 

sum for 1 d s b b 12 08 28 08 23 s 21 0 The cross>sum is therefore too 

low by the amount of the interval from d to 1 in row I of the table 

arranged by numerical value?, namely 6 Q 
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Even when the elements have been transposed in position II and III, 

III and. IV or IV and V instead of I and II, the difference from the 
prescribed cross sum corresponds to the interval between the inverted 
elements in the alphabet,, Thus the difference between dslbv® 

04 09 07 08 23 «22 and the proper cross - sum is 7, and the interval 
from 1 to js is also 7 o 

But transpositions of elements not adjacent in the group are also 
revealed, only the difference vdth' respect to the cross sum is double the 
interval between the interchanged letters of the alphabet if the trans=- 
posed elements are two apart, thrice the interval if the elements are 
three apart and four times if the interval within the group is four 0 Ch 
the other hand if the interval between the interchanged letters is 
computed not in the alphabet but on the row I, H, III or IV of the table, 
according to whether the interchanged elements have an interval of 
1 , 2 , 3 or 4 in a group, then the difference with respect to the cross sum 
indicates the interval of the interchanged letters in the appropriate row 0 
Thus if instead of d 1 s b v the transmitted group reads b 1 s d v « 

02 24 28 16 23 * 6 , then the element d and b corresponding to their 
interval 3 within the group will be at an interval of 23 in row III of 
the table D 

This table can also be used in the form of a 5 ~part slide to 
determine the correct group,, This is illustrated on sheet 2 of the Appendix,, 
If the el merits of the falsely transmitted code group are set 15 ) on slides 
I, II, III, XV and V against column 0 , then in the column indicated by the 

■V •- ■ ■ 

complement to the cross sum of the group with reference to the proper cross'* 
sum 29 can be read off the values which could stand as correct element in 
positions 1 to 5 of the group 0 

If on the other hand the first element of the group is set up vdth 

slide 3 I, II, III and IV set at the 0 column, the column indicated by 

the cross 3 um of the group Will show on the slides those letters Which - 

if they should stand in the 2 nd, 3 rd, 4 th, or 5 th position in the group •= 

would give the correct cross- sum if transposed with the element set up 0 
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In other v/ords: if one of the slides set contains in the column involved u 
letter which is contained in the group at that interval, then interchanging 
this; letter w ith the letter set up will yield the correct crosssura. The 
same experiment must then be made by setting the second element of the 
group on slides I, II, and III, the third element on slides I, and Hip 
and the fourth element on slide I, in order to complete the study. 

By setting up the slides in this w ay all those groups can be read off 
which might stand in place of the garbled group, insofar as ve assume that 
one element of the group is garbled or that two elements have been inter- 
changed. Thus with the group structure based on the crossssum 29 it results 
that any single error in t ransraission of the group and also a transposition 
of two elements will be indicated by a deviating cross /sum and jthat the 
difference between this and the standard cross? sum will at the same time ' 
give clues to the error. 

Just as in the case of the substitution alphabet, it is possible with a 
code to have systematic or unsystematic [random] assignment of meanings to 
the groups and to use one or more groups for any meaning. 

If the code is alphabetic, then when the plain text meanings are arranged 
alphabetically the code groups will also stand in alphabetic or arithmetic 
order depending on whether it is a letter or number code. In this case the 
same code may be used for both encipherment and decipherment. If on the 
other hand the code is unsystematic in structure, then one part must be 
prepared with the plain concepts in alphabetic order for encipherment and 
another part with the code groups in systematic order for decipherment. 

. V- . * 

The increased labor involved and the correspondingly higher costs explain 
why one- part codes are relatively numerous. 

The enciphering part of a code with the plain concepts arranged alphabet- 
ically is often divided by subjects. For instance there are frequently special 
sections for spalling groups, numbers, auxiliary verbs, geographic names, 
personal names etc., in addition to the main section for words and sentences. 

V/ords, concepts, phrases and punctuation marks occurring froouently 
in plain language may be assigned several groups. Depending upon the size • 
of the code, variants may be assigned plentifully so that from 30 to 50 
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different code groups for a single plaiin concept are no exception® Of 
course one must not entertain any illusions regarding the very relative 
value of a large number of variants® 

In some cases the question of variants is handled not by assigning 

. i , . 

several code groups to a single plain concept but by associating several 
plain concepts to one code group® Thus it is possible far each group to 
represent 

1® A word or phrase, 

2® A proper name - geographic or personal, 

j 

I 

3® A spelling group, single element, number etc® 

TChen the second or third meaning is to be taken, this can be shown by 
special indicator groups, in case these are not dispensed with because 
the appropriate meaning is generally obvious from the context® 

Finally the code may be used with groups of varying length so that, 
for instance, part of the' page designations^ will be 1-place or 2-place, 
while the other part will be 2-place or 3-place® 

Regarding the security of a code against unauthorized decryption it is 
obvious that a single message affords no possibility of solution® However 
it will generally suffice to show that the cryptographic system involved 
is a code vdth groups of such and such a length® If several messages are 
available, each individual message must be studied, using a count or some 
other method, to determine whether it belongs to the same code® This must 
be continued until the indicator groups have been recognized to such an 
extent that they can be used for identification® 

If it is a letter code, the group structure must first be determined 
in order to prepare a corresponding code book for the total count of all 
messages belonging to the code® This book provides for each group a 
separate cell or line where the position index for each occurrence of the 
group can be entered® 

After relatively few messages have been subjected to a count, frequent 
groups will begin to stand out as such® From the distribution of these 
frequent groups within the cods it is usually possible to tell whether a 
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one -part or two-part code is involved o For instance , if the basic language 
is French, then with a one -part code thb groups for. a and & , for do, 
de l 1 and de la, for a 1® and a la, etc, will attract attention because 
they come close together, as will groups signifying references or numbers. 
If it is a one -part code, then the number of unused groups . between 
the frequently used groups will afford important clues to the potential 
meanings. If these clues are taken in connection with the frequency of 
the groups and the position of the group in the code text and in relation 
to other frequent groups, it is easy to break into a one -part code with 
relatively little traffic. As an example we will use the following 
actual case. For a one-part four -letter code with unsystem tic group 
structure and a total of about 40,000 groups which had recently appeared 
there were available Just under forty messages of medium length. After 
the group structure had been determined and a blank code had been 
prepared, all the messages were solved completely within a fortnight. 

It is true that the traffic in this case had . fairly uniform content. . 

From this example it can be seen that even in favorable cases the 
energy required to produce a code of such size bears no relation to the 
results if the code is intended as a cryptographic system and not merely 
as a means of reducing telegraph charges. 

If on the other hand a two-part code is involved, then obviously a 
greater amount of traffic is necessary before one can start with the 
interpretation. . Morover the interpretation of such a code makes 
greater demands on the worker's intuition and ability to put two and 

. • V 

two together. But even when a two-part code is of considerable size and 
has many variants, the inferences to bo drawn f rom the position of 
frequent groups and from the inevitable occurrence of parallel passages 
within the code text are so extensive that, although the first attempts 
at interpretation will be groping and cautious, after four to six weeks 
or when a total of one hundred to tvx> hundred messages of average length 
have accumulated, some short messages cun be read in full while in .the 
case of the other messages some guess can be made as to the possible 
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contents.. Chce this stage has been reached# the rest of the work 
usually progresses with gigantic strides. After a 'few more weeks the 
majority of the messages can already be interpreted with fair certainty. 

In this work it will be well to enter the position indices of all 
groups in the blank code until the interpretation of a group has been 
achieved 'with absolute certainty. After thut the meaning originally 
entered in pencil will be entered in ink to indicate that there is no 
longer any question that a synonym might stand in this position. 

All that can certainly be gained with a two-part code is then a 
certain delay in reading during the first two or three months it is in 
use. After that the difficulties of breaking into the code will have 
been overcome by the unauthorized decrypter to such an extent that any 
delay in current reading does not occur or is no longer of importance. 

The reason why even a two-part code can be solved is found in the fact 
that the encoded text always reveals the frequencies of the plain language. 
Even extensive use of variants does not alter this. Even the use of special 
indicator and camouflage groups, such as "read instead of the following group 
the tenth group following in the code" or "at this point read the tenth 
group of this message" can - if carried out consistently - merely prevent 
the occurrence of parallel passages within a single message. It cannot 
prevent the occurrence of paralleT passages in messages sent at different 
times. Such means can# to be sure# somewhat delay solution but they are not 
able to give the system any increased security. 

Consequently, when a code is not intended to shorten the cipher text 
in comparison to the plain teoct and possibly to serve at the same time as the 
basis for superencipherment# the great expense involved in the production of 
the code is out of all proportion to its practical value. 

A glance back over all the substitution systems leads to the h&sic 

conclusion that security cannot be attained by a greater expansion of the 

system# unless it be that one is ready to disregard any ratio between 

expense and usefulness. The only proper course with substitution systems has 

proven to be the use of a multiplicity of systems with a minimum of traffic 
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in the individual system* such as is possible with polyalphabetic 
substitution. !7ith this* however* all the possibilities of the 
substitution systems are exhausted. 
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Furthermore the setting: 

Strip I II in IV yields in I II in IV 
0 ® e e e e 1 = ^ ^ ^ - 

0=1 1 1 1 = ■ — v 

0 *= 8 S 1 e $ 

' 0 c b X o ^ 

Hence the group c v s b 1 yields the cross sum 29 c 


Example 2 

Transmitted group d 1 v b s cross sum 23 


Setting/ in I n III IV V 

yields in I II in IV V 

0 ® d 1 v b s 

6 = f j o • x r a j 

0 = d d d d 

23 — *■ £ b , 

0-1 1 1 

23= t t t 

0 = v v 

23 - 

0 ® b 

23 - i 

Groups with the cross sum 29: 


G3 1 T b 8 d0T b 

s d 1 0 b s d 1 v 

■ 01 ,0 

8 d x 0 b 0 

Example 3 


Transmitted group q v n y o 

cross sum 17 

Setting in I II in IV V 

yields in I II in IV V 

0 «= q v n y o 

^ 12 - - -DO - - 

0 *= q q q q 

17 * 4 £ 4 

0 » v v v 

17 - / jf jr 

0 » n n 

17 - b' h' 

0 ® y 

17 - & 


Group with the cross sum 29: q v fr] y o 
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SECTION B 

TRANSPOSITION SYSTEMS 
Versatzverfah ren 

In the definition of the production of cryptograms by the transposi- 
tion system given at the beginning of this study we have already said all 
that is essential regarding the principle, namely: 

1* Preservation of the elements of the plain language, 

2. Transposition of the sequence according to definite rules, so that 
the only question remaining to be discussed is the way in which the 
plain elements can be transposed among themselves and what security 
can be attained in this fashion. 

1. The limited (short) key number - Die bep.renzte Umstellzahl . 

Che of the simplest methods of transposing the plain elements would 
consist in reading the plain text in reverse order and thus making it into 
cipher text. In this case we speak of an Umstellung or shift. This 
simplest type of shift need not be discussed further because the analysis 
and solution of the. cipher text results automatically. 

More usual is the shifting of the plain text with the aid of a 
limited key number whore this shows the sequence in which the elements of 
the plain text become cipher text. The key number 1 2 3 4 5 6 7 would 
therefore signify no shift since according to this the plain elements would 
remain in their original sequence, whereas the key number 7 6 5 4 3 2 1, 
for instance, would result in breaking up the text into sections of seven 
elements each and taking the plain text of each section in reverse order 
as cipher text. 

On sheet 1 of Appendix I B 1 a plain text has been enciphered using 
a random key number. The one-place chain count (digraphic count) on 
sheet 2, when the cipher elements are arranged according to frequency, 
not merely shows the plain text frequency curve but is the plain text 
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frequency curve since the sequence of the cipher elerrents is the same as 
if a plain text had been subjected to the count. 

This result of the count is characteristic of all transposition systems 
A comparison of the parallel passages on sheet 3 of the Appendix shows 

1. That the parallel passages occur only at a regular interval of 
five and- 

2. That the parallel passages show so-called split off elements 
( abgesprengte Elements ), i.e. the parallel passages can be 
expanded forward or backward by single elements within certain 
short intervals. 

These two phenomena , in connection with the plain text frequency of the 

cipher elements , are characteristic of the limited transposition key with 

regular repetition. The regular interval between parallel passages 
„ * ^ 
reveals the length of "the key. 

If the transposition segment is marked in the cipher text f it appears 
that the stray elements before and after the uninterrupted parallel passage 
do not extend beyond one key segment. Parallels in the plain text, which 
are separated by an interval not equal to the length of the key, do not 

appear as parallel passages in the cipher text. Plain parallel passages of 

1 

slight length which fall in two key segments may also disappear in the 

cipher text, for instance, the plain "tiber" in line 2 column 23 and line 

6 .column 13 of the cipher text no longer at-tracts our attention as a 

parallel passage although it is in phase. 

Since the detached elements obviously belong to the parallel passage 

and are merely a result of the transposition, inferences as to the type 

of transposition may be dravzn from their position. 

If, taking into account the transposition segments marked in red, 

a parallel passage like that in row 1, column 6 to 20, reads: 

d.e.ijjgeinljhs. r_c? 

1 2 3 4 5fl 2 3 4 5(1 2 3 4 5j 

* Inasmuch as the last two letters of cipher text were incorrectly given 
here (re instead of c e) - which, error was detected - it is quite 
possible that other errors exist in parts not checked by the translator. 
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then the last key segment leaves no doubt that in the reconversion to 
plain text the third cipher element of the key segment must become the 
fifth plain element of the segment , if the detached elements are to be 
united with the parallel passage. Furthermore one can conclude from the 
first key segment by the same line of reasoning that the second and fourth 
cipher element must become the first and second plain element when re~ 
transposing. 

Since according to the first key segment of the parallel passage from 
line 2 columns 11 to 25 

| e o kerjeluarj.n . g .i 
1 1 2 3 4 5} 1 2 3 4 5| 1 2 3 4 51 

the second cipher element must become the first plain element when retransposed, 
v/e can infer from the last segment that the fourth cipher element must become 
the second plain element 0 

With this v?e already know that in retransposing 

cipher element 1 2 3 4 5 

Hi 

becomes plain element .152. 

From the first key segment of the parallel passage in line 3 column 
16 to 30t 

I. , e . d/s u h t cjn T . a dj 
ll 2 3 4 511 2 3 4 5*1 2 3 4 51 

He can infer, after the position of the third cipher element as fifth 
element has been determined, that the fifth cipher element must become the 
fourth plain element. 

Then the only possibility left for the first cipher element is that 
it becomes the third plain element so that the entire key reads 3 1 5 2 4a 
But with this the entire cipher text is solved. 

It is also possible, however, to recover the key when the cipher 
text' 3 hows no parallel passages. If German text is involved we can start 
with the plain digraph ch because plain c virtually never occurs 

o • 

except in combination with h and in rare cases with k. 
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On sheet 4 of the Appendix all the c elements have been listed with 
the h lying in the vicinity. Just from the h . . c occurring three 
tines in row 1 column 16 F row 3 column 6 and row 4 column 11 a regularity 
may bo inferred which suggests transposition. The intervals between 
these three occurrences are 50 ® 2 x(|x 5 S 85 ® 5 x 17 and 35 = 5 ; x 7? 
which gives the length of the key segment as 5. Since in. contrast to the 
evaluation of parallel passages we here get no clue to the position of 
c or h in the plain text sequent * vie can only conclude from the occurrence 

t * 

j: ^7 that in the plain text cipher column 4 will stand directly 
before cipher column 1. In the same way we can conclude from, the other 

occurrences of c and h that cipher column 1 must stand ahead of cipher 

column 5 and cipher column 5 ahead of cipher column 3» which already permits 
recovery of the column sequence 4 15 3® 

Finally it is apparent from the occurrence in row 6 column 21 to 30 

! . * c . » ? » h . • o j 
1 2 3 4 5;1 2 3 4 5. 

that if we are to., get the plain text digraph ch* then in retransposing c 
must move from the third place to the fifth place in the first key segment 
and h from the second to the first place in the second key segment. Now 

the sequence of columns can be expanded to 2 4 1 5 3® 

As can be seen from the example of encipherment and decipherment at 
the bottom of sheet 4 of the Appendix* the sequence of plain columns 
3 1 5 2 4» which yields the cipher text* corresponds to the sequence of 
cipher columns 2 4 1 5 3* which converts the cipher text back into the 
original plain text. 

Consequently single digraphs are enough to reach a solution of the 
entire cipher text. Even though solution calls for more cipher text where 
the keys are longer* nevertheless the procedure just described is possible 
as long as the same key number is used repeatedly in succession. Consequently 
transposition using a limited key number only assures security as long as 
the ratio between the length of the key and the length of the plain text to 
be enciphered does not materially exceed about 1 to 3 or 1 to 4« 
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Plain text 
Shifting 
Cipher text 

Plain text 
Shifting 
Cipher text 

Plain text 
Shifting 
Cipher text 

Plain text 
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Cipher text 

Plain text 
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Cipher text 

Plain text 
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Cipher text 

Plain text 
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Cipher text 
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Comparison of parallel passages 
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Evaluation of the plain digraph ch: 

Position of cipher c and h in the shift section: 




Shift sed 
1 2 3 4 5 
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Deduction regarding the shift key . 
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1-5 
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last digit » 3 

5- 3 

Final deduction 
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Relation of the shift key fcr the conversion of plain text to the shift 
key for the conversion of the cipher text. 
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2. Transposition matrix - Per '.tlrfel 

More wide spread than the preceding "periodic transposition" 
involving the use of a short key number ( Umstellzahl) is transposition 
by the aid of a so-called matrix procedure. T.'e speak of a '.tirfel , or 
of a columnar transposition of the plain text, as a crypto graphic system 
when the plain text is written out in several rows one beneath the other 
in a definite width and is taken out column by column according to a key 
number or with the aid of a key word. 

In Appendix I B 2 a the plain text at the top of sheet 1 has been 
entered below in a box 12 columns wide and 11 rows deep. Above this is 
the key number. The cipher text is obtained by taking out columns 1,2,3 etc. 
corresponding to the key and is showm at the bottom of sheet 1. 

A count of the cipher text shows no parallel passages. From the 
occurrence of the individual elements it is clear that a transposition 
system is involved. Hence it is necessary to see whether inferences can 
be drawn as to the type of transposition from the position of the single 
elements of frequent plain digraphs, e.g. the elements c and h. 

ror this purpose there is a tabulation on sheet 2 showing the 
positions in the cipher text where these elements are found. For this 
so-called position count the elements of the cipher text are numbered 
serially. If the intervals between each two neighboring elements c and h 
are computed v;e get for c the intervals 

1 -- 3 4 5 6 7 9 13 15 15 17 18 
and for h the intervals 

111 2 3 4_4 6789 HI 42427 

From this we cannot find any regularity; however the intervals for the 
two letters show coinciding values for the most part. 

If the elements of the cipher text are written out several times 
one beneath the other on strips and these strips are slid with respect 
to one another so that two c a s always stand beside two h»s at the same 
interval and if the resulting digraphic combinations before, between and 
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after the digraph ch are checked with respect to their probability, 
then the setting of c in position 28 beside h in position 114 gives 
below the digraphs gk ei st ch eb he lc sh and above the digraphs 
di si ff gd etc., a3 shown in the columns number 1 and 2 on 
sheet 2 of the Appendix. If now against the two h*s which are 
adjacent in column 1 and occupy positions 24 and 25 in the cipher 
text arc set the two c*s in positions 66 and 67 using a ncv; strip 
(see column 3)# then the following trigraphs result: 

hac hie wgd’iff chn cht ssl rdi ich igk tei ist ich eeb theihlc lhs etc. 

A check shows that between the trigraphs wgd and hlc, which are themselves 
improbable combinations there stand only ciuite likely plain text trigraphs, 
in part very probable trigraphs such as ich, ist, cht. 

In like manner the other c’s and h’s, insofar as thoy occur at like 
intervals, can be associated as has been done in columns 7, 6, 5, 4 and 8 0 

ftice trigraphs have been obtained, it is easy by sliding one strip 
of cipher text to determine where and how an expansion to form syllables 
and words is possible. Columns 4 and 6, which contain the beginning and 
end of the cipher text, limit the depth in which a juxtaposition of columns 
is possible to 11 rows. 

V/ith the plain text we then get the exact form cf the transposition 
matrix and the key number with which the cipher text was formed. 

This method of solution can also be employed when digraphs like "ch 1 ' 
cannot be juxtaposed, either because they are not found in the plain text 
or because the h belonging with the c was omitted in encipherment . 
Although this study may reouire somewhat more time because the first clues 
are lacking, it can be made successfully as long as the box has sufficient 
depth. 

The security of the transposition system depends very decidedly on 
the form of the matrix. This is especially clear in the case of two 
extreme matrix forms: 
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a) ’A’idth 1. The depth corresponds to the length of the message. 


Plain text and cipher text correspond. There is no cryptogram. 


b) Depth 1. The width and the length of the key correspond to the 
length of the cipher text. There is no possibility of solution 
tinless the key number is used more than once. 


From these two extremes it is obvious that a transposition system becomes 
all the more secure the less the resulting depth of the matrix becomes. 

There is no limit to the choice of matrix forms. In Appendix I B 2 b 
a few other forms are 3hown which may be used instead of the rectangle, 
e.g. the comb or the step. However it is also possible to vary the way 
in which the cipher text is taken out of the matrix, e.g. with the 
serpentine transposition where the columns are taken out alternately from 
the top down and from the bottom up or the diagonal transposition where, 
starting vdth particular key number values, we take out first the diagonal 
sequences and then take out the remainder of the elements by columns 0 

This does not eliminate possibilities of solution because with the 
step, comb and diagonal transposition some columns always remain undisturbed 
which can be put together in the familiar manner. Starting with this 
undisturbed block the irregularities resulting from the deviating matrix 
forms can be determined very easily. V.'ith the serpentine pattern on the 
other hand the cipher text must be entered on the strips In both directions 
in order to bring the columns together. Then solution is not more difficult 
than with the normal pattern. 
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Count of the elements 
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T/ith U diagonals 
running downward 
to the right 
01, 03, 05, 07 


Comb 
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3o The grille - Per Raster 

Another possibility of transposing the plain elements is afforded 
by the grille# By a grille we understand a rectangle or square form with 
several rows and several columns with specific cells punched out by the 
use of vdiich the cipher text is derived from the plain text# The so-called 
sliding grille is a rectangular form containing only one punched cell in 
each column o Otherwise the distribution of the holes is purely optional# 

l 

In Appendix I B 3 a the form of a sliding grille is shown on sheet 1 
under the plain text# It consists of ten columns and five rows and 
contains ten grille cells which are distributed over the ten columns at 
random height# 

To encipher the plain text with this sliding grille a rectangle is 
drawn with a width equal to that of the grille or a width less than that 
of the grille may be agreed upon; the depth results from the length of 
the plain text to b e enciphered# Then the sliding grille is placed with 
its bottom row on the top row of this rectangle. In the open cells are 
inscribed the first elements of the plain text# Then the sliding grille 
is moved one row down so that its two bottom rows stand on the two top 
rows of the rectangle# In the open cells is entered the Continuation 

of the plain text# In this way the grille is pushed down a row at a time 

* 

and used to produce a cipher text# If the grille finally protrudes below 
the bottom row of the rectangle these lower cells are no longer used for 
encipherment# 

The cipher text at the bottom of sheet 1 of the Appendix was produced 
in this manner. The l~place chain count (digraph count) on sheet 2 of the 
Appendix reveals no parallel passage# From the frequency of the cipher 

t 

elements it is clear that a transposition is involved# Consequently a 
position count of the elemsnts c and h is undertaken and this is 
shown at the bottom of sheet 2# The serial numbering of all cipher 
elements results in this case from the coordinates of the cipher text 
on sheet 1# 
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The evaluation of this position count at the bottom of sheet 2 shows, 
as can be seen from the extract beside it, regular intervals, e.g. for the 
position values 41, 61, and 161 of c and for the position value 
46, 66 and 166 for h, which in turn show regular intervals. Oh sheet 3 
therefore all the elements c and h have been shown in their proper 
position within the cipher rectangle. The relations bettveen c and h 
which result have been entered in color. 

If the columns are now put together in the sequence and vdth the 
degree of displacement indicated by the difference in the position of 
c to h, e.g. beginning vdth columns 3 and 7 which stand on the same 
level, we get plain text such as appears in the juxtaposition of columns 
at the bottom of sheet 3° 

A comparison of the sequence of plain text columns with the original 
cipher text finally makes possible a reconstruction of the original 

v 

sliding grille if, beginning with the bottom row, holes are punched in 
those cells of a grille form containing the first elements of the plain 
text. A comparison of the beginning of the cipher text at the right on 
sheet 3 with the grille cells marked in color beneath shows the way this 
reconstruction is accomplished. • 

The cipher text obtained with the sliding grille shows a marked 
relationship with the simple box method. The difference lies in the 
fact that with the sliding grille the single columns must be juxtaposed 
at different levels. This displacement of columns, like the sequence of 
the columns, is a result of the arrangement of the holes in the form. 

The grille therefore replaces at the same tin© the key number of the box 
transposition. Due to the great correspondence of the two systems in their 
effect on the cipher text both have the same degree of security. 

On the other hand the so-called revolving grille has a very i different 
effect on the cipher text. The revolving grille is square and hence has 
a total of 16 cells if thero are four on a side, 25 if there are 5 on a 
side, 36 if there are 6 on a side, 49 if there are 7 on a side etc. This 
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revolving grille is turned clock-wise about its center on a cipher square 
of like size in such fashion that the upper edge of the grille coincides 
first with the upper edge and then successively with the right edge, 
bottom edge and left edge of the cipher square # Consequently the pinched 
cells must be so distributed that during a complete revolution each cell 
of the cipher square becomes visible once 0 Corresponding to the 4 
positions of the revolving grille one quarter of the available cells 
must be punched out# When the number of cells on a side is odd the 
central cell remains unused# 

In Appendix I B 3 b two revolving grilles with an odd number of cells 
are shown on sheet T and three with an even number of cells on sheet 3<> 

The openings which correspond to one another as the grille is turned are 
always given the same numerical designation# The punched- cells have been 
shaded in color# 

The plain text at the top was enciphered with grille 1 and grille 2 
and is contained in the cipher text squares and the cipher text rows la and 
2a o At the same time there has been enciphered with the two grilles a 
number sequence from 01 to 25 (see cipher square and cipher text rows lb 
and 2b) in order to illustrate the systematic character of the revolving 
grille# 

The encipherment of the number sequence shows that, independent of 
the form of the revolving grille, certain regularities appear in the 
transposition resulting from the use of the revolving grille# These 
regularities are apparent from the schematic representations found on 
sheet 1 and sheet 3 of the Appendix# 

A study of the cipher text shows, in contrast to the preceding trans- 
position systems, a single peculiarity, namely that the length of the 
cipher text corresponds to the square of a simple number# . Hence the 
length of the message is an important point# If this leads us to infer 
that a revolving grille has been used, then - due to the effect of each 
grille opening on four elements, - an assumption as to how two holes are 
placed with respect to one another always leads to four deductions 
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regarding the plain text. 

Consequently it is a help when solving a revolving grille if one can 
succeed in picking out in the cipher text plain text digraphs which are 
characteristic of a language 9 e.g. ch in Germany qu in French^ so as 
to have a fixed starting point . 

On sheet 2 of the Appendix is shown the reconstruction of a grille 
from the cipher text* In row la are entered all c°s and h 5 s . If it 
is assumed that the elements c and h taken out of the square to the ri$it 
form a plain digraph fi then two openings have been determined, as shown in 
the square at the right 0 From this assumption it also follows that no 
additional openings can be punched between these two cells o Moreover the 
fixing of the first two openings rules out the possibility that certain 
other cells v&ll be openings . All these cells have been crossed out 
to indicate that they no longer come into account as openings if the 

original assumption is correct „ 

\ - • 

From row b it is clear that upon turning the provisional grille once 
to the right one of the two openings falls on an ho If this h should 
belong to a digraph ch 6 only the . c in the same row would come into 
account since due to the peculiarity of the grille the first plain element 
after the shift remains as the first cipher element . The deductions result- 
ing from this digraph with respect to the opening and to cells not punched 
are entered once again. 

In row c the revolving grille has been returned to its initial 
position Since the last hole entered again falls on an h with a c 
not far ahead of it, the inference is natural that these t>vo elements belong 
together. After entering the resulting deductions in the revolving grille 
only four cells remain unmarked. 

If p using this provisional grille, the plain text resulting from the 
four settings is written out in rows dp e, f 8 and g with a notation of the 
possible plain text elements for the four questionable cells, then the 
elements in the upper row can be united with part of those possible in the 
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lower row to make plain text, if the original assumptions xvere correct 0 
The security of the revolving grille is limited by the fact that 
several messages in the same key can be solved without further ado and that 

i ...... 

even the security of a single message is not guaranteed® Even though the 
cipher text offers no clues to characteristic digraphs of the plain text, 
the regularity Inherent in the revolving grille is so great that small 
grilles at least are always capable of solution® 

With larger revolving grilles it is a great disadvantage that the 
messages have to be padded to fill out the next higher square® 

A further disadvantage, which like the time consuming cipher 
procedure is common to all grilles, is the fact that even minor 
garbles, in particular the omission of single elements can make the 
entire message unreadable even for the authorized decrypter® 

Finally it is a common .weakness of all transposition systems 
that the regularities originating in the plain language lay a trans- 
position system open to attack if it has a systematic structure like 
the grille and the box® The characteristic thing about the box is 
that one key number is valid for several rov/s so that certain depths 
result® 

Of course transposition systems other than the common ones thus 
far described are conceivable; however this probably wall not alter 
the basic ideas regarding the value and solvability of transposition 
systems® 
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The grille is placed with its bottom row 
on the top row of the rectangle whose 
width corresponds to tha t of the grille 
and whose depth corresponds to the length 
of the text and the plain text is entered 
in the open cells „ Then the grille is 
moved dowmud a row at a time and the 
plain text entered in the open cells « 
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Elements arranged according to frequency . 
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Position of the elements 


"c" and M h n in the cipher text 



Composition of the columns 
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1234567890123456789012345 
Plain text: unrechtgutgedeihtsehlecht 
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I B 3 b 


Reconstruction of the grille 
s open cell * no opening possible 
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DP-240 Part II 5/52/^»«66/AFSA-U 

CHARACTERISTICS , ANALYSIS AND SECURITY 
OF CRYPTOGRAPHIC SYSTEMS 


1. Attached is an Armed Forces Security Agency translation of 
Part n of a treatise on cryptology prepared by Dr. Bruno KROGER, 
formerly with the Forschungsanrt . German title: Systamatik, Analyse 
und Sicherheit der Geheimschriften . 

2. This treatise purports to cover in detail the work given in 
the course at the Forschungsamt . Since the methods described here 
arejjessontially different from those used by AESA, the primary 
value will be found in the picture it gives of the approach to these 
problems of another major cryptologic unit. 

3* Appendices follow the section of text which they illustrate. 


Translated: R.W.P. 35 copies 

January 1952 

Distribution: Normal 57 pages 
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COMBINED AND SUPERENCIPHERED SYSTEMS 
’ Since to a great extent the basic systems have not met security 
requirements, there has been an ever increasing tendency to encipher 
once again the text already enciphered in the basic system in order in 
this way to achieve a higher degree of security* 

When one of the know basic systems ie used for the second encipher- 
ment, w© have a combination of two basic systems and speak of combined 
systems in contrast to the superenoiphered systems where special methods 
have been developed for treating the cipher text produced by a basic 
system* 


SECTION A 

COMBINED SYSTEMS 

(Korablnlerte Verfahren) 

V 

The extent to which increased security of a cryptogram can be 
achieved fay reenciphering a text produced by a basic system making use 
of a second basic system depends upon the choice of the basic systems to 
be combined* For instance a second encipherment of a single substitution 
text using a second substitution alphabet yields no increase in security 
because the unauthorised decrypter would not notice that there had been 
an intermediate encipherment* If in the first alphabet a * b and in the 
second substitution b • c, it would be eimplier to substitute at the 
outset a «= c and the security would bo the same. 
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lo Double transposition 

( per Doppelwtirfel) 

Cki the other hand if a cipher text enciphered by a matrix transposition 
is reenciphered vdth a second matrix, the result is quite different. After 
the first encipherment it is still possible by writing out the cipher text 
on strips and by sliding the strips to determine the positions in which 
fragnent 8 of plain text are formed at a certain depth; the same course of 
solution is no longer of use when the first cipher text has been reenciphered 
by transposition, i.e. when we have a double transposition as it is called. 
When f oil owing the same method of solution used for single transposition, 
the problem would be to find by sliding these stripe those positions in 
which the oipher text of the first matrix arises. Since the criteria 
available for a p l a i n text cannot be applied in the earn of a cipher text, 
this problem is incapable of solution. 

The unauthorized decrypter confronted vdth a single text produced by 
double transposition is usually merely able to determine that a transposition 
system is involved. All attempts at solution with a single text are doomed 
to failure unless it be that the plain text contains exceptionally long 
parallel passages. 

Even when one and the same double transposition is used a number of 
times for different texts there is usually no possibility for the unauthorized 
decrypter to break into tha system as long as the texts are of distinctly 
different lengths and contain no relatively long parallel passages. 

Chly in special cases where several cipher texts of identical length 
and in the same key are available, where the cipher text shows exceptionally 
long parallel passages which must extend at least over two box widths of 
the first word, or where the same double transposition was used for several 
messages of approximately equal length and these messages contain rather 
long parallel passages which exceed the width of the first matrix. 13 it 
possible to solve the double transposition from the cipher text. 
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In Appendix II A 1 a on sheet 1 is a text of 180 elements divided 
into six seetions I to VI of 30 elements each* Beneath are the two matrices 
with keys by which these sections are enciphered* In matrix I the first 
thirty elements are represented by the numbers 01 02 03 .*. 30* Matrix II 

contains the cipher text produced by the first transposition 03 08 13 18 23 etc* 

* r* 

From this matrix U is derived the cipher text II corresponding to the key* 

At the bottom of sheet 1 are the 6 cipher texts with designation of the plain 
columns (or of the shift nunber ( Ornate llzahl) produced by the double trans- 
position), 

A solution is sought by first arranging the cipher text columns (e.g* 
on the basis of like indicator groups and like length) so that plain text 
results* In the Geiman language the plain digraph ch or ck may afford a 
starting point* After marking the elements c, h and k in the cipher text 

it is obvious that columns 12 and 13 belong together* From the c and h 

| » 

remaining in cipher text V it is apparent that columns 28 and 29 belong 
together. 

These pairs of columns 12 13 and 28 29 are written out at the top 
of sheet 2* A check of the resulting plain digraphs shows that the 
2nd, 3rd, 4th, 5th and 6th digraph of coitions 28 and 29 probably call 
for a preceding vowel in German* Only column 27 contains five vowels in 
the 2nd to 6th position* The 1st, 3rd, and 5th digraphs of columns 12 and 
13 likewise call for a preceding vowel. Chly columns 11 and 24 come into 
account* Starting with the trigraphs thus obtained it is easy to match the 
remaining columns. 

By comparing the plain text thU3 obtained with the cipher text it is 
possible to obtain the numerical key* 

Since this key has been derived in systematic fashion from the double 
transposition, it is a question of recognizing the systematic feature by 
studying the sequence of cipher columns. For this purpose the difference 
between the column designations, of which the key number is composed, have 
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been derived at the bottom of sheet 2. These differences reveal parallel 
passages. If the sequence of cipher columns is divided up in differences 
corresponding to these parallel passages and if these segments are then 
arranged by columns corresponding to their first digits, the result is the 
arrangement shown lower down on the sheet which reveals the systematic 
character of matrix II. After that it is an easy matter to derive matrix I 
from matrix II as shown at the bottom of sheet 2. 

Cta sheet 3 is given a second example of the reconstruction of the 
transposition matrices. Although the parallel passages in the differences 
are not quite so clear here because of the wider but shallower matrices, 
we do get the division into columns for the entire sequence of columns. 

The first elements of these columns can be arranged by the interval 7 
(i.e. the width of the first matrix) into the series 01 08 15 and 03 12 19 
26 33, which together yield the first row of matrix II. If we enter first 
the complete row 0$ 12 19 26 33 and then the row beginning 01 08 15 (which 
is supplemented by 22 29 in the second row of the matrix), the reconstruction 
of matrix I follows as a matter of course. 

I 

This proves that several messageein the same key will lead to the 
reconstruction of the two matrices if the messages have the same length. 

When messages in the same key reveal parallel passages extending 
beyond one row of the first matrix, then solution is possible if the 
messages are of approximately the same length. 

An example has been worked out in Appendix II A 1 b. The three plain 
texts of the example have 58, 56 and 90 elements respectively and have the 
same plain text beginning (something which occurs all too often in actual 
traffic because of stereotyped references and telegram beginnings). These 
three texts have been enciphered on sheet 1 with the same double trans- 
position and the parallel passage has been underscored in red. A check of 
the colimms of matrix II for plain texts A B and G which yield the cipher 
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text, reveals that texts A and B with the similar lengths of 58 and 
56 elements still contain recognisable fragments of the original 
parallel passages, while the fragments in the longer text of 90 elements 
are so distributed that the passage can no longer be recognized in the 
cipher text. 

At the top of sheet 2 cipher texts A and E have been written out. 
Underneath is a 1-place chain count made to discover the parallel passages. 
These parallel passages, which consist merely of digraphs, have been 
marked in color in the cipher text and have been framed in red insofar as 
their position in the cipher texts is identical or corresponds to the 
difference in length. 

Prom the distribution of the like or almost like positioned parallel 
passages in text A and B we infer there are six columns and therefore that 
the width of matrix II is 6, From this and from the length of the messages 
we get for cipher text A a matrix II with four columns of ten elements and 
two columns of nine elements and for cipher text B a matri x with two columns 
of ten elements and four columns of nine elements. 

If the like positioned digraph Her j in the first row of text A and B 
is not to be torn apart, we get for column 1 of text A and B a depth of 
9 elements. The division into columns has been indicated in the cipher text 
by jf , It is now possible to indicate by one or more vertical lines ij | 
the possible positions for separating the other columns, taking into 
consideration the number with the depth of 9 and with the depth of ID, 
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From the possible separation 

in cipher text A: . * . . s f j i I t i 2 | . . . . • and 

in cipher text B: . , . , r u | e j j i zj • • * • « » 

it results that only the aeparatibn between 1 and t in text A and between 
u and e in text B # i*®* 

in cipher text A* » . • . a f 1 | t|_I ss| • • • • . 

in cipher text B: , , . . . r u f ej 1 gj * • • ■ • 

can convert the almost- like positioned digraph Iz into a like positioned 
one in the matrix* With this the depth of column 2 in text A is fixed at 
10 and in text B at 9 elements* 

In corresponding fashion the almost like positioned digraph i se? can 
be made a like positioned digraph if the separation £br column 6 ( ) 

is made between e and s in cipher texts A and B« 

With this the length of columns 1, 2 and 6 are determined* Qice the 
length of these columns is fixed their possible position in matrix II is 
limited* Under 1) on sheet 3 are shown the possible positions of columns 
1, 2 and 6 in the matrix* 

Now if the repeated digraphs which are not in like position and which 
stand in different columns in text A and B are not accidental, then from 
their position we can deduce in connection with the message lengths of 58 and 
56 elements that the B-column in which a repeated digraph appears must stand 
ahead of that A-column in which this digraph appears again. Moreover these 
columns must stand at an interval of 1 or of 2 beoause the total length of 
messages A and B differs by only two elements. 

Under 2) on sheet 3 these repeated digraphs are shown with their positions 

and the resulting inferences regarding the sequence of columns is noted at the 

» * 

right* 

Since it was shown under 1) that column 2 and column 6 can stand only 
in the 3rd or 4th position in the matrix and since it is shown under 2) that 
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columns 2 and 6 follow one another at an interval of one or two*, it ie 
certain that column 2 must stand in the 3rd position and column 6 in the 
4th position in matrix II* 

If column 3 or 5 is to stand ahead of column 6 at an interval of 1 
or 2} it results that only the second column of the matrix remains open* 

This enables us to place column 4 in the first position. 

Since it may also be assumed that the like positioned digraphs f£T| 
in columns A1 and B1 and .- £ 2 ) in columns A3 and B3 are adjacent in 
both matrices* we deduce from that as shown under 4) on sheet 2* that 
columns 1 and 3 are adjacent and therefore occupy the 5th and 6th 
positions in the matrix. 

With this the key number or the column sequence of Box II is 
fixed either as4526l3oras 452631<> When the columns from 
sheet 2 are put together in these sequences on sheet 4» the parallel 
passages show that the sequence 4 5 2 6 1 3 is the correct one. 

The parallel passages in matrix II deeignate at the same time the 
beginning and end of the columns from matrix I as written out on sheet 4 
at the bottom. The matching of these columns to get plain text, i.e, the 
reconstruction of matrix I, causes less difficulty since it results from 
the length of columns under A that the 3rd and 5th columns must stand in 
the 1st or 2nd position in matrix I. 

Th8 combination of two matrices for a double transposition has therefore 
brought a significant increase in security because a single text enciphered 
by double transposition is not capable of solution and even where several 
messages in the same key are available a solution is possible only under 
very definite conditions. 
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Matching cipher columns 
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Sequence of cipher columns with differences 


Sequence of 

cipher columns 26 16 09 29 17 10 30 6$ 06 26 19 07 27 20 

Differences: \2 Q 18 £3 20 18 23 20/ 18 18 20 23 18 20 23 23 

II ~ IV 


Sequence of 

cipher columns 01 21 H 02 22 15 @1 23 11 04 24 12 05 25. 


18 20 23 18 20 23 16 
III 
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I II HI IV 
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Example of the reconstruction of the two boxes 
Plain texts 01 02 03 04 05 06 . . 


33 



2 7 5 6 1 4 3 
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08 09 10 11 12 13 14 
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Cipher text 

Sequence of , 

columns 19 07 03 25 ! 01 28 24 09 05 22 20 1l 30 15 13 04 

}. \ / \ 

Differences 21 29 22 09 27 29 18 29 17 31 24 19 18 31 24 19 

Sequence of 

columns 23 33 21 17 02 12 29 27 18 08 06 31. 16 i 26 14 10 32 j 

Differences 10 21 29 18 10 17 31 24 23 31 25 18 10\ 21 29 22 / 

The elements of the first row of Bax II: 19 01 05 15 33 12 08 26 


IS3LJ& 




Hence Bax n reads: 


and Bax I reads: 
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22290714a 28 06 13 
20 27 03 10 17 24 31 04 
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Matching Columns: 


1 ) 


Position of columns 1,2,6 on the basis of 
Column lengths A 10 10 10 10 

- " B 10 10 9 9 


their depth in A and B. 
9 9 
9 9 


Position 


1 1 


2 2 
6 6 


2) Sequence of columns on the basis of like digraphs: 


Digraph 


t o 
s t 
i s 
e e 


Column 


A 1 
A 2 
A 6 
A 6 


and B 6 
" B 4 


4 2 

B3/B5 If. 

B 2 j2jfi 


Sequence of columns: 
6l or 6*1 
4 


3 

5 ‘ 6 
2 • 6 


2 

6 


3) Joining l) and 2) 



4) The like positioned digraphs ad in column 1 and iv in colu m n 3 mean that 
columns 1 and 3 sue adjacent. 


Hence* J 4 5 2 6 3 jj 


II A - 1 b - 3 
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Matching the cipher columns 


A 


B 


452613 

or 

4 5 2 6 3 i 

a s 6 s f t 


a s s s t f 

e t r e a 1 


e t rje v i. a 

e g e e d / 


e g e e zjl 

h n e n r e 


hue n e”r 

o n q ,e_t i 


o'nj: e i t 

e d i e o e 


e d i e e o 

m r g n l~n 


m r g n n 1 

r i sips 


r i s i s p 

n a f s u n 


n a f s n u 

m e 1 g j 



452613 

or 

452631 

as ss a e 


a s s s e a 

n s r e. r i9L i 


n s r e i_a 

s o s r d 7 


6 o s r • d 

h n e h as 


hne h s a 

nee _t c r 


n/c e t r c 

d e e o e m 

*rr : . . 


d e e one 

r r u p r i 


v u p x *; 

s i r d a s 


s JL t d s a 

f s u n p r 


f s u n r p 

l ef 

l_ e J 


A asssftet 
r~e‘a”T e g e e 
dzh n e n r e o 
n_c e_t i e d i 
e o ejajc g n 1 n 
vX.b. i P s n a 
fsunmeig 

—XT*’ w 


** asssaens 
r’e al r o s r 

d z h n e h a s 

ncetcrde 

• **?xrrrajwssa.fc* 

e o e mr v u p 

rl» l r d a s 

f 3 u n p r 1 e 
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2. Matrix transposition with grille# 

( Wtirfol mit Raster) 

In many respects the combination of a simple matrix transposition with 
a grille works out in much the same fashion# The procedure consists in 
marking off in the matrix the open squares of a superimposed grille and 
not using them for encipherment « Since the grille is neither slid nor 
tumed« there are no rules or limitations regarding the arrangement of 
the grid cells# The text to be enciphered is entered horizontally in the 
matrix omitting the cellB blocked by the grille and is then taken out by 
columns according to a numerical key# 

In Appendix II A 2 two plain texts A and B have been enciphered 
with the same matrix in the same grille# The blocked cells of the grille 
extend only to a certain depth which is less than the utilized depth 
of the matrix# The two texts have two fairly long parallel passages# 

If a sufficient number of grille cells are blocked and if their 
distribution is unsystematic# it results that a matching of transposition 
oolumns by plain digraphs is no longer possible in the grille area# A 
single cipher text enciphered by this system is therefore secure against 
unauthorized decipherment if the blocked cells are distributed In 
sufficient density over the entire matrix# Chly when several texts 
in the same key and of the same length are available is solution possible. 
The method corresponds to that used for double transposition# 

If several messages in the same key but differing In length are 
available# relatively short parallel passages in the plain text will 
no longer be recognized in the several cipher texts. Chly parallel 
passages with a length exceeding the width of the matrix can appear as 
parallel passages in the cipher text# provided they are like positioned 
or if the grille cells correspond at the two positions # VJhen such 
relatively long parallel passages in the plain text as "der franzdsische 
Aussenminister " of our example are in phase, then they appear in the 
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cipher text (see parallel passages framed in brofm in cipher text A and B 
on sheet 2) in the same position when the cipher texts are identical in length 
and in nearly the same position when the cipher text are of different length,, 
The similarity of position consists in the fact that the sequence of the 
parallel passages is the same in the two cipher texts and that their 
intervals stand in a definite relation to the total length of the messages* 

The number of like positioned parallel passages corresponds to the number 
of colunns in the matrix if thair length is adequate. If the parallel 
passage stands at the beginning or end of the plain text, then the parallel 
passages fom the beginnings or ends of the columns of the cipher texto 

TChen the parallel passages in the plain text, e.g. "der nSchsten 
Aussenministerkonferenz " in our example, are not in phase, then the parallel 
passages in the cipher text appear in a deviating sequence. Their number 
may correspond to the width of the matrix; their intervals stand in 
relation to the message lengths. 

If the columns of cipher text A, whose number and length in the present 
case are given by the parallel passages, are juxtaposed as shown in the upper 
left comer of sheet 3, we get the characteristics of the grills -matrix: 

1, Deviation of more than one element in the depth of the column; 

2, The parallel passages of the plain text belonging to the parallel 
passages of the cipher text also show differences of length in 
excess of one element, insofar as they have been influenced by the 
grill© „ 

By merely looking at the columns in the upper left comer of sheet 3 we can 
see that in this example the grille affected only the upper part of the matrix, 
A comparison 


In columns 

1) Of the length of the repeats framed in brorai 

2) Of the interval to the next parallel passage 

3) Of the length of the repeats framed in green 

4) Of the interval to the end of the colisan 


123 4 56789 

3 3 4 4 4 ^3 32 
U 2 3 2 3 3 2 2 
3.2^343333 
44it£ 4 4 4 5 4 
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shows on the basis of the differences in length that the repeats framed 
in brown and also the text ahead of the repeats framed in green lie in 
the area of the grille while the remainder of the message was enciphered 
with a simple matrix* 

Corresponding to the lower portion (no longer influenced by the grille) 
the columns can be arranged for the moment in three groups (sheet 3 at the 


upper 

right ) t 


I. 

Length of the repeat framed in green 

4 elements 


Length to the end of the column 

4 elements 

n. 

Length of the repeat framed in green 

3 elements 


Length to the end of the column 

5 elements 

III* 

Length of the repeat framed in green 

3 elements 


Length to the end of the column 

4 elements 

If the top of the repeats framed in green are brought to the same level 


the lower half of the grill-matrix, which is not influenced by the grille, 
is yielded* 

Taking into account the c and h standing on the same level we get the 
sequence 5 3 8 4 7 1 (middle of sheet 3 at the left)* For the remaining 
three columns the sequence can be determined by the resulting plain text* 

After the sequence of columns and the lower part of the plain t ext in 
the matrix have been recognized, it is possible to reconstruct the grille 
portion row by row working up from the bottom in such fashion that all 
elements which do not fit into the plain text are pushed up and the vacant 
cells are marked as grille cells (see middle of sheet 3 at the right ) s 

Even easier is the reconstruction of the matrix on the basis of the parallel 
passages not in like position (framed in green)* When the pairs of columns 
which are connected either in the two texts (in our example A and B) or within 
the same matrix by a parallel passage which is not like positioned, then a 
transition sequence can be derived (bottom of sheet 3) which either contains 

21 


TOP SECRET 


Doc ID: 6592460 


TOP SECRET 

{ 

the numerical key of the matrix or from which this key can be derived 
since these transition sequences are Elated to one another like the 
substitute slide of the short slide* 

The two methods of solution given are, however, ways of solving the 
simple matrix transposition which can only be used insofar as the grille does 
not extend over the total depth of the matrix employed or the grille is so 
little developed that parallel passages of the plain text can be recognized 
even when not in phase* Consequently these types of solution do not affect 
the security of the grille-matrix substitution as such* 
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12 3 

123456789012345678901234567890 


Plain text: 


DERFRA 
B'EABSI 
S E N L' I N 
U M A N P L 


NZOESISC 

CHTIGTAU 


ENMINISTER 
ECHSTENAUS 
AUCHDENSCH 
ZURSPRACHEZU BRINGENX 
118 elements 


T E R K 0 


H E A U S S 
P D E R N A 
N F E R E N Z 


D E 
E R 


R 
K 

K 0 N 
U N 
N I 
S I 
I N 


RANZOESI5CHEA 
AERTEAUFDERGE 
7DASSERI 
IEERHALT 
H L A S S E N *7 
VONDERNA 


F 
L 

F S R E N 
B HU1!D 
HTNA 
H V I E 


U 


C 

L 


STKRKONFEREN 


K S 
U N 

R 
E 
X 


b b 


T R 
£ I 
G D 
R D E 
CHS 


K N M I N I 
E N P R 
N B a s 
F R I E D E N 
R E R H 0 F F 


S T 
E S 
T R 


NA1IS 


R 
E 
B 
S 
E 

S E N M 


197 elements 


Transposition box with grille 


2 

3 

4 

5 


144 A.O 9 6 2 


DjTlE R F Rf A N 

Z O0E syTi S C 
T:iH E AfjUS Sjj 
E N II I N lgs‘T 
E R(£JB EAlSl 


B 


1 

22 

3 

4 

5 


148.4 .7 1 _9__6_.2 

DOER F R 


6 

C H T I G TpAOl 

6 

RT 

7 jUFDERNA Kfii 

7 

1 E R 

6 ! 

ICHSTENAUS; 

8 

| G E 

9 ! 

SENKINIST1 

9 

; K 0 

10 SE R K 0 N F E R E i 

10 

| D 4k 

11 

NZAUCHDEN; 

11 

! E I 

12 ) 

schumanpl: 

12 

‘R E 

13 i 

ANZURSPRA 1 

13 

: M D 

14 j 

iCHEZUSRIN 

14 ! 

i T U 

15 1 

!g e n x ! 

15 

I E 



16 

H T 



17 

S E 



18 

E R 



19 

S I 



20 

0 N 



21 

H S 



22 

e n : 



23 

R K j 



24 

z xl 


Z 01;,. E S L 
CiH E aQu 
E N M I N 
* ** Ge R IV 
A U F 
£ S T 


S E R 


BUNG 


N A C H 

; E R 


C H V I 


T E N A 


A N 
S C 

ssa 

T 

LAE 

IIdOI 

r id: 

s s e : 

N Z i 
N S i 
S T I 
N U : 

a l : 

F 

I 

A 
E 
F 
L 

E 
S 


E 

I 

E 

H 

S 

N 

L 

D 

F 

K 


R 

C 

S 

X 

E 

7 

C 

s 


S T E 
REN 
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Cipher 

text 


B 


12 3 

123456789012345678901234567890 

© ® $ 

RUIATNNNFHAS BNCTISTENLANOHNRHF 

HERZCNAEREAlBIETMOUUU ZXDZEECUC 

(D 

SENSACGASSSSAEUSREPRIFSNEGREIN 

(§) — © ^ 

CMROEEMTDSNKAHZENISBAAIEDNPR 

0-0 


•3T 


~G£T 


RUIKFTERRBGRESHROINAIENCTEEZST 

ULRCSXEVCSENOHNRTREOAIEDUETERI 
<2> » 
NSNKXREAIEAEDFSCUEGEAWRHEEINDZ 

EEREGEDERMTIHSESOHERZASSSADISN 

— 

NSNAFIAEFLESTEFSNRUSREEMMEDNCE 
(g) (§) 

HVRNNFEEMEGNNSNBINDNNEC DTMOISL 


RSEIEEHSNLDFEAUSR 


Di graphic count of cipher texts W A W and n B n 



A 


B 

A 

“t'S NT 6 s E H A I 

A 

lllEWSDFEU 

B 

N I A 

B 

0 I 

C 

T N U S G M 

C 

T S S U E D 

D 

ZSH 

0 

UZEINNTF 

E 

NRRATECNU 

E 

RSNEZVNODTRAAPGAEIER 


PGIEMHD 


GDRS IEHAR PS FENDHEMGC 

F 

H H S 

F 

T S I L S E E 

G 

A R 

G 

R E E N 

R 

A N F E E Z 

H 

R N E S E V S 

I 

ASBEFNSE 

I 

RNEENENHSANSE 

J 


J 


K 

A 

K 

F X 

L 

A 

L 

R E R D 

M 

0 R T 

M 

T E 0 

N 

NNFCLORH 

N 

ACORSKDNSARN 


S E C K I P 


ECNFNSBDNEL 

0 

H 0 

0 

I H A H I 

P 

R R 

P 

F 

<* 


Q 


R 

DHZEEIEV 

R 

URBEOCTEIEHEUZUENS 

S 

BTEASSSARNNB 

S 

HTXENCEOSSANTNRNLENR 

T 

N I E M 0 

T 

EEUREIEM 

U 

I U 0 Z C S E 

U 

I L E E S S 

V 


V 

C R 

w 


W 

R 

X 

0 

X 

E R 

T 


T 


2 

C X E E 

Z 

SEA 
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1 

2 

3 

4 

5 

6 

7 

8 

9 










R 

N 

0 

R 

D 

A 

F 

E 

I 

3 

5 

4 

8 

1 

2 

6 

7 

9 

U 

C 

H 

E 

Z 

S 

S 

E 

S 










I 

T 

N 

A 

E 

S 

N 

M 

B 

0 

D 

R 



: 

A 



A 

I 

R 

I 

E 

s 

E 

T 

A 

H 

Z 

E 


R 

S 

S 

F 


T 

S 

H 

B 

C 

s 

G 

D 

A 

N 

E 

A 

E 

U 


S 

S 


N 

T 

F 

I 

U 

A 

R 

S 

I 

R 

E 

I 

E 

I 

N 

S 

N 

I 

N 

E 

H 

E 

c 

E 

E 

N 

E 

<$>(£> 

B 

U 

A 

C 

S 

E 

S 

N 

N 

E 

T 

s 

U 

I 

K 

0 

F 

U 

I 

T 

T 

T 

A 

G 

B 

F 

L 

R 

M 

E 

S 

N 

A 

N 


E 

D 

N 

I 

E 

R 

A 

H 

A 

Z 

0 

N 

R 

C 

H 

D 

E 

S 

T 

S 

N 

S 

U 

E 

A 

A 

N 

C 

U 

S 

E 

M 

Z 

R 

R 

E 

M 

N 

N 

T 

S 

I 

I 

S 


N 

u 

A 

P 

R 

E 


Z 

N 

0 

K 

F 

E 

R 

N 

E 

B 


H 

u 

C 

R 

U 

N 


(£ 

S 

U 

A 

(2> 

N 

E 

<2> 

D 



E 

z 

X 

G 

I 




(§><£> 

u 

u 

? 

A 

S 

L 

A 

P 

R 

M 

R 

N 

P 










E G 

■Ol— »'■' 

z 

X 

E 

N 

B 

fJK 

N 

♦ » mn 

JL 

U 

R 

5 

3 

8 

4 

i 

7 : 

L 

2 

6 9 

1 A 

5 

3 

8 

4 

7 

1 ' 

9 

6 


@<jD 

U F 

S E 
E R 
N Z 

s (£> 

A N 
G E 


B E A 


T 

I 

G 

T 


A 

B 

D 

E 

R 

N 

I 

E 

A 

S 

T 

E 

N 

S 

U 

A 

N 

M 

I 

N 

T 

S 

I 

K 

0 

N 

F 

E 

R 

E 

A 

U 


N 

E 

0 

(5) 

u 

U 

A 

L 

P 

N 

z 

u 

R 

S 

A 

R 

P 

E 

z 


B 

N 

I 

R 

N 

X 







N U 

R M 
H T 
F D 
H S 
E N 
R K 
N Z A 
S C H 
A N Z 
CHE 
GEN 


E S 

A & U S S | 

I N I 0 S T 

A B S I 


B E 
I G 
E R 
T E 


U 

0 
u 
u 
u 

Z U B 


I 

N 

C 

M 

R 


t m a 

N A E 
N A 
I 
E 
D 
N 
P 
R 


U 

S 

R 

E 

P 

R 

I 


S 

T 

E 

N 

L 

A 

N 




Parallel passages not In like position are found In cipher texts "A" and "B" 

In column 123456789 of text B 
" " 958732146" " A 

Transition sequence ; 1962j5 38471962;53847 
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3o Substitution with short transposition key* 



When a test enciphered by simple substitution is shifted in the second. 

■ • . ' i' . 

operation using the transposition kby of limited lengthy the count shows the 
normal distribution of a substitution system but solution as a simple 

*» . * . i * 

substitution is impossible 0 A correct analysis can only be reached through 

the supplemental evaluation of the parallel passages on the basis of detached 

* * * * 1 

elements characteristic of the short k6y transposition,, 

- 1 i 

.. insofar as parallel passages do nbt appear in the cipher text; either 
because , there are none in ' the plain text or because they no longer appear due 
-to the transposition^ the system can be regarded as secure* It also results 
that the security of the system increases with the length of the transposition 
key« The amount of traffic which can be enciphered with security stands 
therefore in direct relation to the length of the transposition key <> . 
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4» Substitution with matrix transposition** 



If a text enciphered, by substitution is then transposed, the count of the 

cipher text will- show the frequencies of the substitution but will not show 

the parallel passages characteristic of the simple' substitution provided the 

matrix width is. so chosen that any existing plain text parallel passages 

will not extend beyond the width of the matrix*' Even the frequency of 
speoific digraphs characteristic of the substitution will drop out* - 

Solution as a substitution is impossible until the natural linguistic 

sequence is' restored in the cipher tsxfc e Furthermore solution as a simple 

transposition will' not be possible because there is no criterion for the 

correctness of Juxtaposed digraphs and trigraphs « Analysis of the cipher 

text will only be possible if cipher texts, in the sans key contain parallel 

passages which- can only .arise from parallel passages in the plain text .with 


a length greater .than the width of the matrix^ or when errors' have been 
made in encipherment which may give the analyst clues regarding the system , 
used* Such errors include a wrong use of the numerical key or the omission 
of elements when enciphering which makes necessary a repetition of the . 
message o If this repetition,. is enciphered with the same raatriXp then a 
comparison of the two cipher texts may reveal the number and length of 
the column and allow deductions as to the system* 

Consequently this combination of substitution- and transposition affords 
good security as long -as traffic is light and the alphabets and matrices 
can be changed often enough and provided care is taken when enciphering to 
prevent the occurrence of parallel passages longer than the width of the 
matrix in messages in the same key* 
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5<i Cod® with short transposition key 0 ' 

, < . 

, • / 
j : 

j ; 

Wten a cods text is transposed tjjr a key, the value of the. combination 

depends on the ratio of t he length of the code group to the length of the key* .. 

•. . ' . v;- ;y. • . . * 

If the length of the key is the same ak the length of the code group, there 
is no essential increase in the difficulty of solution because the frequency 
of the individual groups and the parallel passages remain unchanged and 
frequent groups can be recognized as such in the transposed forau * 

Xf s on the other hand, the length of the code group and the length of 

'■> .* • • 

the key have no ccnsnon factors, the product of these lengths gives the 
interval at which genuine parallel passages can appear for the first tin©. 

Hence the security of the system increases with the length of the key*. 

Even before parallel pas sages appear it may be possible to analyze'* 
the system by making a count of the individual elements* » As a rule a cipher 
text produced with a particular code will show, .after a certain amount of 
traffic has accumulated? a curve characteristic of that code for the frequency 
of the single elements of which it is composed 0 • If, far instance^ - the most 

. _ > . 1 * • it 

frequent groupie of a 4"*digit code are 0081 0830 7880 9009 8088 etc* a count 
of the individual elements 0 to 9 will show marked peaks for 8 and 0 o - 






6 ? Code with matrix transposition 

f ■ • • 4 

( Code mlt TOrfel) , , 

From an analytic point of v^ew the combination of code and transposition 
works out in much the same way® Since with the code of lO^OOO or more groups 
relatively long parallel passages are rare* it is possible to avoid recognisable 
parallel passages in the cipher test if the matrices have a certain minimum 
width o From the frequency curve for the single elements some idea of the code 
is obtained and hence a recognition of the fact that a code with transposition 

* * * K 

is involved o If a message which was originally transmitted with errors is 
repeated* this may permit recognition of the use. of matrix transposition. 

If the matrices and key numbers are changed often enough and if proper 
precautions are taken* this system affords a very high degree of security* 

If the code Is unknown* then even bad errors in encipherment will permit 
recovery of this or that matrix only in exceptional cases. But as long as 
these cases are the exception and the keys are changed frequently it will 
not be possible to accumulate enough material to solve the unknown code* 

. , ’ . . <f , . 

In spite of the relatively high degree of security such a system can 
only be used in the long run with low traffic density because the frequent 
sources of error and the time required would become too burdensome. 





7. Polyalphabetic substitution vdth short transposition key or with matrix. 



Inasmuch as the proper use of polyalphabe tic substitution alone affords 

a high degree of security for a I large amount of traffic, the combination of 

» ; 

a polyalphabetic substitution ( Sprjngcflsar or 
transposition key or a matrix is rare in actual practice because the 
expenditure of time involved by the second encipherment is generally regarded 
as superfluous, • , 

This does not argue against the use of the combination since a good 
substitution system can only g ain in security by reencipherment with a 
transposition system, > ! ' 

The combination of two basic systems mentioned in the foregoing 
chapters virtually exhausts the possibilities. It has bsen shown that 
reencipherment usually results in a noticeable gain in security. This 
explains the relatively wide use of such systems despite the increased 
expenditure of time. Other combinations which are theoretically possible 
are very seldom actually used whether it be that the increase in security 
is not significant or tha t the cost in time is too great.; * 


with a short 
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. Section Bo 
Supsrsnciphered Systems 
( ffberschldaselte Verfahren) 


' Special systems have been; developed for subjecting the text pro- 
duced by- a basic system, the so-called intermediate text (Grandtext), to 


another encipherment dr superenciphement j, so that from the int ©mediate 
■ text the final text arises# These systems of superenciphement differ 
from the basic systems through' the fact that by means of the superen- 
ciphement a plain text cannot be transformed into a cipher text directly 
,but the superenciphement can only be applied to an intermediate text 
produced by a basic system# 


1# Encipherment by substitution table# . - a . 

Tauschtaf eiaberschlflsselungen # 

If the text produced by a digit code is so changed that 
■ from a 0 1 2 3 4 5 6 7 6 9 

• a 4369280517 

alBjays results, then beyond doubt a X-plac© substitution is involved 
which is much like a CBsar # But since here me do not have a plain se- 
quence standing over against a cipher sequence but rather a cipher se- 
quence n, that is involved is a superenciphement system which has 
become' known under the designation Tanschtafel (substitution table)# 

Such one-place tables may be used as letter substitution tables or 
digit substitution tables for the superenciphement of the text produced 
by a letter or digit code# 

As long as the substitution tables are not changed very often, the 
result, in respect to increased security, is only slight# 

For instance, if the 1-place substitution table reads as fftUo&s: 
Cipher sequence I 0 1 2 3 4 5 6 7 8 9 

Cipher sequence XI 6 3 9 1 5 0 8 2 4 7 

and the code text to be enciphered shows the following groups; 
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1344 4314 0878 4488 5346 4408 1348 
then the supsrenciphered text II,. . , 

3155 5135 6424 5544 00.54 5564 3154 
would agree tsrith the intermediate text in structure Just as a simple 
Cgsar fails to conceal the structure of the plain languages , Even with- 
out picking out such constructive parallel passages and evaluating the 
result s p certain frequent groups with a characteristic group structure 
could readily be reduced to on© another * To seme extent a reduction 
would be possible solely on the basis of the frequency of. the individual 
elements*.- ’ 

On the other hand, if analogous to the SpringcBsar or Spaltencgsar 
several 1-place substitution tables are used in unsystematic sequence 
and at short intervals such a superenciphermsnt would cause both par- 
allel passages and passages of similar construction to disappear en- 
tirely so that any solution of the substitution tables and hence any 
solution of the cipher text becomes impossible P provided the same se- 
quance of substitution tables is not used repeatedly* * ■ 

The 1-place substitution table for enciphering a digit code may also 
have letters in cipher sequence II so that the digit text becomes a 
letter text* Since in this case there are 26 elements in cipher seq 
quance II against 10 elements in cipher sequence I it is possible to 
use variants* fcflth the table; • 

Cipher sequence I 012345 6789 

Cipher sequence n edigahe j b f 

tkqvrnslmp 
u - o - W s x - y - 

the digit group **2G45 W may be replaced in the superenciphered form by 
the following groups; 
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i c a h' 

i c .r.h 

i c tr h 

lean . 

i c r n 

i'ctr n 

leas 

i c r a 

i c w a 

i t a h 

I t r h 

i t w h 

i t a n 

it rn 

i t vr n 

it u 

i t r a 

i ,t w a 

i u ah 

iurh 

iuvh 

1 u a n 

iu r n 

i u w n 

i u a a 

i u r a 

i u w % 


q c a h q c r h q e tr b . 

q can q o an ® • • «i etc® 

ocah ocrh ocvh 

ocan ocrn ® ® ® •• ® . etc* 

Henc© for each 4-dlgAt group there ar© from 2^ to 3^5 from 16 to 81 

possibilities of encipherment so that even rather long parallel passages 

can be so enciphered each time as to get such a different structure so 

that recognition of the parallel passage may become a difficult or even 

impossible task and no reduction of the tables can be achieved if they 

are changed often enough® 

What has been said about the effect of the 1-place substitution table 
holds true in increased measure for 2 , 3 and more place tables® The 
greater the number of substitution table groups becomes which have to be 
reduced to one another, the more traffic will be required befos? any re- 
duction can be attempted® If the tables are changed so promptly that 
enough material for reduction of any table can never be secured,, then 1 
the security of the supereneipherateat is guaranteed® 

There is the additional fact that in the superenciphermeirt of 5-place 
code groups by 3-place substitution tables any reduction on the basis of 
constructive similarities of the individual groups may be difficult, es- 
pecially since parallel passages of the intermediate test I only appear 
in the final test H when they are in phase® 

If a multi-place substitution table is used not to encipher the inter- 
mediate text serially but column by column when written out In appropri- 
ate form, then each three >place group of the table might encipher three 
single elements from three different code groups, even covering different 
positions in the several groups® 
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If substitution tables are combined tri.th a simple transposition of the ■ 
intermed i ate test in this teay p clues for any reduction can be eliminated; 
even ■when there is a rather large amount of traffic » say taith rare 
change of key - to such an extant that any solution of the substitution 
tables becomes impossible* 
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2 0 Additive 

Die Sberschiaaseiimgszahl a 

For digit codes a special method of encipherment has been developed 
rahich consists in the addition of a So-called ffberschjgsselunggaafal 
(additive) to the text produced by the code* Almost without exception 
symbolische Addition sweise (addition modulo 10) is used, i<.e* the tens 
resulting from the addition of single digits are .disregarded? Thus if 
we add 

to cod© test 026834324691493411 

the additive sequence 943761234943761234 

the final cipher test II reads 969595558534154645* 

If the additive la 1-place or if the number of places coincides with 
the number in the code group, the following situations results 
Code text: 0513 2419 5506 8129 0523 

Additive: 6666 6666 6666 6666 6666 

Cipher teat H 6l£2 8075 1162 4785 6179 

or 

Code tests 0513 2419 5506 8129 0513 

Additives 2583.2583_25M 2583 2583 

Cipher text II 2096 4992 7089 0602 2096 , 

In both cases, all the repetitions of the code text are preserved and in 

% 

*♦. 6 > 4 # 

addition the differences between the individual code groups remain un- 
changed* If the basic code is knom to the unauthorised cryptanalyst, 
the enciphered text II can be reduced to the basic code on the basis of 
the unchanged differences between the groups* 
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These differences are also deterainedj symbolically (mod 10). The • 

question as to which of two code groups compared is the minuend or the 

• ! • . i " ‘ . ' 

subtrahend is settled as a matter of principle according to the least 
possible difference between two numbers.. For instance, if the numbers 
8129 and 0234 are to be considered, then symbolic subtraction yields 
these possible answers 5 

■ v :,: ; ' 8129 . 0134 . 

; > mk : m i 

8095 and 2015. 

Of these two values, which are coo^ljamentar^ywith respect to 0000, we 
consider only 2015 as the least difference. If the code groups under 
consideration reads 


8129 

3173 

317? 

8129 

.5056 

5054s 


then it is only the last place which determines the direction in which 
the difference is to be taken. In certain border line cases, eig. with 


the groups s 




8129 

8129 

8129 

8129 

8124 

mk 

8629 

■■.Bill 

3679 

0005 

5055 

0500 

5550 


we get the same difference both -ways, irrespective of which group -is 
taken as the minuend. . 

By determining the least differences between the groups of the cipher 
text it is easy to recognise the use of an additive with a known code. . 
Reduction to the basic code is then simple. 

If the basic code is not known, then the enciphered code groups can 
be. reduced to one another starting with any arbitrary assumption in case 
of a long additive or of a change of additive, but collectively they 
only fern a relative code. If the basic code has 4--dlgIt groups, its 
groups differ from those of the relative code by a constant difference 
which lies between 0000 and 9999. Therefore a 4®place basic code is only 
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osi© among 10 o C00 possible relative codes o If the additive is neither a 
single digit nor of the same length as the basic code group, a period 
results which is equal to the least common multiple of the length of the 
additive number and the number of digits in the code group! 

Appendix H B2 shows an intermediate text I consisting of 5-digit 
groups which is transformed into the final cipher text II by the addi- 
tion of a recurrent 6-place additive* The numerous parallel passages 
of intermediate text I no longer appear in cipher text II save for those 
standing at an interval of 30 or some multiple thereof (i 0 e s the least 
common multiple of the 5 digits of the code group and the 6 digits of 
the additive )« These parallel passages with the length of the code 
group or a multiple thereof occurring at regular intervals which are 
likewise the length of the code group or a multiple thereof, do not re- 
veal the frequency characteristics of plain code and are indicative of 
the fact that additive encipherment is present » 

Since the differences of the enciphered code groups in the several 
columns of the appendix mere not changed by the addition <£ the additive 
number, wevmay Infer from like differences between two groups of one 
column and two groups of another column that the groups in question may 
have been alike in the intermediate text I® 

Consequently on sheet 1 all the least differences have been given 
column by column with an indication of the direction in which they were 
formed 0 At the top of sheet 2 these have been tabulated with an indi- 
cation of the position of the groups which were differenced,, 

In all cases where the difference of two groups in one column corre- 
spends to the difference of two other groups in another column we can now 
make the assumption that the same two groups of the basic code are in- 
volved* Even though enciphered groups often show like differences al- 
though the underlying code groups are not the same, this course may be 
taken because the assumption mill prove correct in the majority of cases* 
Thus if the difference of the groups 30625 01420 in column 1 rows 
a and c, of the groups 22133 93933 in column 4 rows d and a, and of the 

37 

TOP SECRET 


Doc ID: 6592460 


the groups 59477 20372 in column 6* b and d is in each case 39205 * 
than it Is possible to assume that the minuends and subtrahends corre- 
pond to the same groups of the basic code, If -m add 00000 to the groups 
of cdumn 1, 18592 to the groups of column 4 and 81258 to the groups 
of column 6* we reduce the potentially corresponding groups of columns 

' * . i 

1* 4 and 6 to the values of column 1, The numbers added in this way 
to the groups of a column are called Redaktionszahlen (reduction num- 
bers )* because with them the groups of the various columns can be re- 
duced to a eamm©n relative code. These reduction numbers are found as 
differences between the minuends and subtrahends which together yield 
the same least differences. 

At the bottom of sheet 2 the like least differences have been 
evaluated in this fashion and the resulting reduction numbers obtained, 

A comparison of the reduction numbers with one another shows that they 
confirm one another with the exception of the reduction number belong- 

‘ • ’ . ' i s 

ing with least difference 52962 which means that in this case the .. s' 
assumption that like code groups yielded the same difference was false. 

After cipher test IX has been reduced to a relative eode by the aid 
of the reduction numbers obtained* the reduced test shows the same rep- 
etitions as the original intermediate test I, 

If the code is unknown and the additive is random* then we have gone 
as far as possible with the solution of the superenciphement. Solution 
of this relative code could be attempted as soon as enough material has 
been reduced. 

If* on the other hand* the basic code is known* then it is well to 
reduce the messages to the basic code by the reduction number 

which is easily found. 

If the earns basic code is enciphered successively with different 
additives* it is always necessary to seduce to the seme relative code. 

For this purpose and for all reductions of enciphered text of the same 
basic code it is very advantageous to use a so-called Oifferengenkatalog 
(table of differences). This table of differences contains the 
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differences between all frequently-^curring groups of the ease codeo 
Underthe same difference are entered these cod© groups tjhich together 

produce this difference* It is well to us© several tables side by 

8 , ' * . * 

side; one will contain only the differences between the most frequent 
code groups; a second* the difference between the most frequent and less 
frequent cod© groups* and the third* only the differences between the 
less frequent code groups* Go the other hand* if one prefers to have a 
sing le catalogue* the groups yielding the same difference may be 
■ arranged in the order of their frequency or notations regarding the fre- 
quency of the groups may be made* say with the letters a* b* c 0 

Using a good difference table* columns with a depth of only four or 
five groups can be reduced to one another even in the case of an un- 
known codes After solving the code even lesser depths can be reduced 
to one .another with the aid of the tables 

When* as in the present ©sample* the additive period of 30 elements 
has a length equal to the product of the number of digits in the cede 
and the number of digits in the additive* it is possible to recognise 
the structure of the additive from the reduction numbers for the various 
columns fcy finding the intermediate differences ( Zwischendif f erengen ) 
between the several reduction numbers* At the bottom of sheet 3 we find 

i 1 t ‘ 

the repeated number 4 2 9 8 5 2 which results from the intermediate 
difference of adjacent cdunm reduction numbers gnd is constantly re- 
peated with cyclic displacement * 

A comparison. of 4 2 9 8 5 2 with the original number 3 5 4 2 7 9 
shows that the number .&$2 9 8 5 2 is made up of the difference of ad- 
jacent elements of the original additive* Hence from the number 
4 2 9 8 5 2 v® can derive 10 additives with the same relative construct- 
ion of which one is the original additive* Since the additive and the . 
reduction number* insofar as both are used in the additive procedure* 
are complementary* the reduction number must be formed according to the 
complement to 4 2 9 8 5 2* i»e© according to the number 6 8 1 2 5 8* , 
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At the bottom of sheet 3 ■ of the appendix. are found the resulting re- 
duction numbers which lead to enklof ten possible relative codes® On 
sheet 4 the encoded teat I has been recovered with the aid of the now 
reduction numbers® 

As this method of solution shows, ah additive of limited length 
can not afford adequate security when used with the code because the 
differences in the single columns permits recognition of the original 
code groups® 

On the other hand* if the additive is so used- that it is not possi- 
ble to match up by columns the code groups enciphered with the same 
additive number, than a solution is out of the question® 

Consequently, if an additive is to be used more than once, it will 
be necessary to subdivide the additive, let us say by row and column in 
a table, so that the additive is taken out by a different route each 
time® As long as the same route is not used frequently this will pre- 
vent lining up the test by columns® 

Of course the safest way of using additive is to us© it once only® 

For this purpose on© can either use for each message to be enciphered a 
new additive sequeno© as long as. the message, or an additive of unlimited 
length may be used starting each message where the last ended® 

As equivalent to a one-time additive me may. regard several uses of 
the same additive sequence if the starting points are chosen so as not 
to correspond to the length of the code groups, e®g® if era additive d 
sequence divided into 5-digit groups is applied to 5-digit cod© groups 
so that the starting point will be first on the first element, next on. 
th© second element, then on the third, fourth, and fifth element of a 
specific group® ... 

It may be appropriate to mention at this point th© way in which 
additive sequences of considerable length were derived - originally by 
the Russians - from a short key number without repetition of the addi- 
tive® This method is primarily suitable for emergency keys or agent 
systems since the basic material required is little or none® 
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In Appendix H B 2« are shown the beginnings of several- additive se- 
quences derived from various hey numbers* Adding- mod 10 the first and 
second elements of the key number gives the first element of the addi- 
tive? adding the second and third elements of the key number gives the 
second element of the additive, etc*? finally adding the last element of 
the key number and the first element of the additive gives the next 
element of the additive and the process is not? continued starting at the 
beginning of the additive sequence* 

Ssassples 1 to 3 and 4 to 6 show that even the slightest deviation in 
too otherwise like key numbers very quickly affect the additive sequences 
so greatly that they soon shew no agreement despite the almost identical 
key numbers® (If two key numbers agree in x consecutive element s 8 this 
agreement shows up in x -1 sections of the length x for (x-1) - (x=2) - 
(x-3) » ®o<»®®(x“X) elements® 

Examples 7 to 9 shoe how the combination of two key numbers into a 
single key works oat® • ; 

Example 10, on the other hand, shows how an error in deriving the . 
additive from the key multiplies® Roar a shows the correct additive, row 
b,the change occasioned by the emission of one element, and row c, the 

effect of a falsely computed element of the additive® Example 11 shows 
. . • •• . * . " / 
how a mistake in the key number itself works out® The error and the re- 
sulting deviations in the additive have been marked by an x® 

These last two examples lead to the conclusion that this derivation 
of the additive sequence simple as it at first appears - must be limited 
in practice because it is not everywhere possible to make the inevitable 
careful check on the accuracy of the additive before it is used® 

Repeated use of the same additive sequence derived in this fashion 
must also be greatly limited for security reasons since additives thus 
derived show regularities, as is revealed by the study in Appendix II B 
2 e sheet 2 of additives produced by 2- and 3-place key numbers® These 

regularities include the fo3Llawing characteristics: 7 - 
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1«) If 6 and 5 have regular intervals within the additive sequence* 
e*g« with the numbers OQL* 04* *0li3* 026 then the second half of 
the additive consists of the complements of the first half a 
2») If 0 and 5 have no regular Intervals within the additive se- 
quence* there is a second additive number resulting from the 
complement of the first additive sequence* e»g« with the key 
numbers @01 and 009? 002 and 008* 003 and 007* 00 4 aad 006 o 
3 a ) Various additive sequences can be derived from an additive se° - 
quence by symbolic multiplication* e»g® in the case of key 
numbers 01* Q4 and 05 or 001* 002* 003? 004* 005* 006* 007, 008* 
009 or 013 and CS6® 

4a) Each 0 in the additive leads to the formation of pairs at defi- 
nite intervale which depend on the length of the key* If the 
pairs are represented by x and the intervals by dots* we get for 
3-digit keys the two regularities s OCbcassx and 0® 0 
In the tabulation in the squares on sheet 1 and sheet 2 we can see 
by the colors which key numbers lead to the same, additive number with 
cyclic displacement® For instance* if the additive derived from, the key 
number CQ3 begin® with 0333669251* etc**, the numbers 033* 333* 336* 366* 
669* 692* ete« as key numbers yield the same additive; hence all the key 
numbers connected through the same additive number have been entered in 
the same color in the squares® 
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Column 

reduction 

number 

Cipher text I 
Additive 
Cipher text II 

Reduced text 

Cipher text I 
Additive 
Cipher text II 

Reduced text 

Cipher text I 
Additive 
Cipher text II 

Reduced text 

Cipher text I 
Additive 
Cipher text II 
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00000 42985 66173 18592 93734 [8 1258 


0 5 2 0 8 
3 5 4 2 7 
3 0 6 2 5 


1 3 2 7 6 
9 3 5 6 2 

06718 


3 5 9 4 2 
7 9 3 5 4 
0 4 2 9 6 


1.60 0.3 
2 f9 3 5 
9 3 9 3 8 


89165 

rriv 3 

21858 


13276 

5 4 2 7 9 

6 7 4 4 5 


3.5A2_.5 48693 60369 0 1 4 2 0 1 4 5 8 2 ]4 8 6 9 3 


2 8 2 3 8 
3 5 4 2 7 
5 3 6 5 5 


5 3 6 5 5 


1 3 2 7 6 9 .5 4 63 4 2 2 1 6 

9 3 5 4 2 7 9 3 5 V 2 7 9 3 5 

o£j 1_8 61717 6 9_l 4 1 


13363 05208 
42793 '5 4 2 7 9 
55056 59477 


48693 27 8 8 0.77633 8780:30625 


XJ003 35942 

3 5l2 7 9 3 5 4 2 
01420 28484 


25139 13363 
7935427935 
94483 30298 


p 8 2 3 8 65138 
42793 54279 
609 2. 1 19307 


0142060369 50556 487800365590555 


8 9 16 5 
35 4 2 7 
14582 


2 5 13 9 
9 3 5 4 2 
1 8 6 7 1 


8 7 8 0 4 
7 9 3 5 4 
5 6 1 6 8 


05208 
2 7 9 3 5 
2 2 13 3 


4 2 2 1 6 
4 2 7 9 3 
8 4 9 0 9 


7 6 0.0.3 

5^279 
2 0 2 7 2 


Reduced text 

Cipher text I 
Additive 
Cipher text II 


1 k * 8 2 50556 12221 3Jt 6 jL}’ 77633 OJL 4 2 0 

13276 76003 7 6 0 0 3 4 2 2 1 6 8 9 1 6 5 9 2 4 6 3, 

3 5 4 2 7 9 3 5 4 2 7 9 3 5 4 2 7 3 3 5 4 2 7 9 3 5 *4 2 7'9' 

48693 6954545357 69141 21858 46632 


d 


Reduced text 



Difference 


a 

a 

a 

a 

b 

b 

b 

c 

c 

d 


2 3 
3 9 
2 6 


4 7 
34 


3 Oi 00000. 4358 9t 3489 7t 3420 84 1807 8v 
0 5f 2277 64 1081 3f 4736 0i49l73>5296 21 

4 3# 1296 34. 5295 2^ 3920 54 4795 9f 4 7 27 3^ 

7 84 4727 3t 4116 H 3489 7t 0000 0» 2181 3f 

3 5t. 227764.3377 64 3995 3tl597 54 4017 0i 
7 3t 1296 34 1566 97 4701 87 3995 34 3920 51 
6 27 4727 3f 2646 07 00000. 3420 8t 13 84 5t 

6 24 1 0 8 1 37 4 8 3 3 571 8 1 6 5 * 2 4 0 8 84 l 1 9 7 5j, 

7 34 411614. 5197 4i- 399 5 34 491 5 3t 3733 5v- 

114 5l 9 7 44li80ir 470l8^ 4795 94 2646 0i, 


e 


II B 2 b - 1 
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Count of least differences* 


OOjj 

1 

2 

3 

4 

3 

XO 

1 

2 

3 

4 

5 

6 

7 

8 

9 

20 

1 

2 

3 

4 

5 

6 

7 

8 

9 


30! 


li 
21 

35 776eb3. 


873cd2. 

80Lde3. 

963da2. 

l 62 dcl. 


873ac3. 

975dc6. 

963db2. 

845be6. 


062 bel. 6 ^ 5 bd 3 . 975cb5. 


078 eal. l65cd4. 0 ? 8 ab 6 . 


873 ae 6 . 

776 c a 2 . 

030ba. 

088dc5. 

l43adl. 46obe.3 460ed6. 


llleai. 897ba6. 897ae4. 208ba5. 208be5. 


335ec6. 


205 acl. 205da4. 953be4. 953ec4. 953&b5. 

205 M 6 . 

ITObcS. 

l 6 lec 2 . l 6 lea 3 . 


40 
1 
2 

3 ! 589ab3. 
4 


273ecl. 273 ae 2 . 36o»c4. 078bd4. 078ed4. 
959ed5. '959e45. 273ad6. 273be2. 

335cd3. 

173 bdl. 173ca5. I73ce5. 

9?4ed2. 974ec3. 

235bcl. 962da3. 962ca6. 

••• . • • cm • ■ tw 


Determinin'; the reduction numbers. 


Difference Position 


3 9 2 0 5 


1 8 0 7 8 

2 6 4 60 

To 8 1 3 

3 9 9 5 0 


lac 

4 d a 
i ld 


T9 17 3 

4 1 1 6 i 


lea 
6 a b 

3 b e 

6 e d 

3 a c 

2 c d 

4 b c 

5 d b 


Grous I 

3 0 6 2 5 

2 2 13 3 
■ 5 .9. 4 7 7 


Group XI reduction number for column 


4 8 6 9 3 
-6 -7.4 4 5 

6 17 17 

-4,66.34- 

0 4 2 9 6 

2 8 4 8 4 

691 ~ 


0 1 4 2 0 ,0 O 0 0 0 k 

93938/18592 \ 

.J5.Q 2 7 ZAM~ g-iyl 

3 0 625 0000 61 \ 

-5 9 4- 7 7 /-§ 1 2 5 8 1 

6 5 3 5 7 

2 0 2 7 2 


1 

4 

6 


8 4 


4 1 

9 0 9 



1 b a 
-5-.C a 


TT 6 TT 

60921 


T 7 27 3 


2 e c 
3 e a 


1 e c 

2 a e 
6 a d 


5 7 9 7 6 


2 9 6 2 


2 a d 

_3_S_c_ 


6 9 5 4' 5 

44J-IZ 

486 9 3 

0 6 7 1 8 

6 7 4 4 5 


3 0 2 9 

5 5 0 5 6 

l~4~TB~2 

2 18 


2 8 4 8 4 
0 4 2 9 6 


3 a a 
6 c a 


“69 5 4 5 

Jl5.3-.5JL 


5 6158 

1 9 3 0 7 


014 2 0 
6 9 5 4 5 
2 0 2 7 2 

TffTi 

-ZJUl 



T 6 ~ 1 7 3 S 

g 9.8 1 

S 7 T 592 

9 3 7 3 4 


0 0 0 O ' O' 

3JL11 


Jv 


298 

“6 6 1 7 34 

,0 0 o'<T6* 

2985 / 

8 l 2 5 8 ^ 


1 

A. 

3 

_6_ 

3 

2 

T 

5 


T 


2 

JL 


2 9 


0 4 2 9 

6 7 6 6 5 




z 


T 

2 

6 


3 9 


3 
2 4 


2 

3, 


3 

6 
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44 


TOP SECRET 


Doc ID: 6592460 


TOP SECRET 


Difference Catalogue 


00 

197: 48780 




48693 



1 




2 

36ls 14582 




12221 



3 

109t 53655 



4 

50556 



5 

10 

873; 60369 




50556 



1 

801: 12221 

975: 01420 



01420 

90555 


2 

963: 50556 

875: 50556 



48693 

48780 


3 

845: 30625 

162: 14582 

308? 27880 


27880 

01420 

14582 

4 




5 

062; 53655 

975: 53655 

669: 27880 

6 

48693 

48780 

12221 

7 

714: 60369 

374: 77633 



53655 

60369 


8 

078: 48693 

165: 48780 



30625 

306# 


9 




20 

931 t 50556 




30625 

1 


1 

813: 68693 

900; 68780 



27880 

27880 


2 

776: 60369 

689: 60369 

776: 12221 


48693 

48780 

50555 

3 

030: 53655 

922: 90555 



30625 

77633 


4 

088j 77633 

037: 14582 


5 

53655 

90555 


6 

143; 30625 

460: 27880 



16582 

01420 


7 

187: 77633 




50556 



8 

404: 30625 




12221 



9 

205: 30625 




01420 




II B 2 b 

45 


- 3 (a) 
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30 

1 

2 

1 

4 

5 

6 

7 

8 
9 

40 

1 

2 

3 

4 

5 

6 

7 

8 
9 

50 

1 

2 

3 

4 

5 


776: 50556 
22880 

897i 01420 111; 48693 208: ^8780 

77633 14582 145$ 14582 

875: 53655 472: 48693 569: 48780 

27880 12221 12221 

335: 27880 
90555 

205: 30625 040: 77633 953: 77633 

01420 48693 48780 

170: 30625 009: 90555 

90555 50556 

434: 53655 161*. 01420 

12221 60365 

589: 6 



698: 12221 
77633 

074: 50556 
14582 

078: 77633 900: 90555 273:68693 360: 68280 959: 14582 

30625 53655 07420 01420 77633 

335: 50556 
12221 
173: 53655 
14582 
257: 27880 
77633 
974: 01420 
50556 

235 i 53655 962: 90555 96?; 12221 875: 90555 

07420 “ 48693 60369 48780 

1 

223: 14582 


30 

1 

2 

1 

4 

5 

6 

7 

8 
9 

40 

1 

2 

3 

4 

5 

6 

7 

8 
9 

50 

1 

2 

3 

4 

5 
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Study of reduction numbers 


Reduction number In column 


Difference of reduction numbers 


1 

2 

3 

4 

5 

6 
1 


0 0 0 0 0 
4 2 9 3 5 
6 6 17 3 
1 8 5 9 2 

9 3 7 3 4 
8 12 5& 
0 0 0 0 0 


1*2 

4 2 9 8 5 

2 + 3 

2 4 2 9 8 

3 + 4 

5 2 4 2 9 

4 + 5 

8 5 2 4 2 

5 + 6 

9 8 5 2 4 

6 + 1 

2 9 8 5 2 


Original re enciphe rment number 


S JULLa 



4298524 


Possible reduction numbers derived according to the complementary value of the 
intermediate difference 6 8 1 2 5 8: 

08916 4, 19027 5, 20138 6, 31249 7j 4 2350 8, 

53461 9, 64572 0, 75663 1# 86794 2, 97805 3. 


XI B 2 - b - 3 (c) 
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Reduced cipher text 


Reduction number |0 8 9 1 6 4|0 8 9 1 6 4|0 8 9 1 6 4|0 8 9 1 6 4jo 89164 ) 
Column Ilj2|3|4|5|6 | 


Reduced cipher 
text 


3 8 5 3 1 
5 15 61, 
0 9 3 3 6 
12 4 9 8 

4 6 5 0 


4 6 5 0 9 

4 6 5 0 9 
0 0 1 5 Q 

5 8 4 6 2 


6 8 2 7 5 
2 5 7 9 6 
1 4 5 3 5 
10 13 7 


9093360933675549 


0 9 3 3 6 
5 5 5 4 9 
5 4 18 8 
3 8 5 3 1 


1249846509 

4669638531 

4429579619 

7554909336 

1249825796 


Reduction number |7 5683l|75683 l|7 5683 l|7 5683 1(7 56831! 

|ll2|3|4l5|6| 


Reduced text 


0 5 2 0 8 
2 8 2 3 8 
7 6 0 0 3 


1 3 2 7 6 
1 3 2 7 6 
3 5 9 4 2 


8916525139 
11 3276576003 


3 5 9 4 2 
9 2 4 6 3 
2 5 13 9 
8 7 8 0 4 
7 6 0 0 3 


7600389165 

4221613363 

1336328238 

0520842216 

4221689165 


1 3 2 7 6 
0 5 2 0 8 
6 5 13 8 
7 6 0 0 3 
9 2 4 6 3 
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Key number =• SZ Reencipherment number (Iz ( s additive) 


1) 

SZ 

1 3,4,5 01 

i 



****'* *"*' ' ' *— ■■■*■■■■ 'M WI 


rr 

uz 

14 7 9 4?9fj7 0 

3 ^ 

6 jfjO 0 3 5 9jo 

3 8 4 9 



312324355673 

013581 

483952 

1 . 

0 • # 0 

2) 

SZ 

134500 






ft 

uz 

.'V.OJ’Sgli « 5 4 is' 

7 6-9 9 9 &' 

7 S 9 8 8 1 !9 

w 

6 7 

6 9 0 5 

V 



33595 3}6 8 4 434 

428778 

i 

605454 

4 5 

9 9 9 0 

3) 

SZ 

UJtXP 1 






rf 

uz 

47951^164666 

700223 

m 

702450 

- ^ 

7 2 

6 9 5 7 



98542 673968 3 

025413 

279545 

9 6 

• « « 0 

4) 

SZ 

If 

-LU.-4 0 2.0 A 1 9Q31 

8 0 £ 





• l 

UZ 

8 074224509361 

8 6 7 1 

646959 

2 9 

7 9 4 



02 15 8700544116 

6, 3 4 2 7 |3 

570598 

5 2 

,7 2 9 

T~| i 


7 6 '9 iO'fs 2 7 5 4 7 3 7 Q Q T 6359 

8 i ;0 5 2 9 1 

C 0 

6 8 0 ... „ 

5) 

SZ 

173402041^033 

8 0 6 1 - 





n 

uz 

S-0.7 4 2 2 4 5 0 9 1 6 1 

8 6 7 9 s 8 7 

1 6 4 6 9 5 

9 2 

9 7 9 



i. 3 6 7 IIS.? 0 0 ? 4 4 1 

16637932 3 570 

5 9 

852 



0 6 2 5 5;8 2 7 5 4 7 3 7 9 9 1 

968703 

. 0 <; 

_4vJ. 



006800 . 

* » 




6 ) 

SZ 

173402041. 9 On 

8 0 6 1 2 / 

.. , 





ft 

uz 

8074224509361 

8 6 7 3 0 k 

7. 1646959297 



> 

9 4 3 0 3 8 ] 5 8 70054411663 

7 3 3 1 3:3 

5 7 

0 5 9 



8 , 5 2723006446 18 

275473 

799190 

6 0 

8 0 4 

, JL iB 


092910068009. 

o £> e- e $ c 

a « 
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7) SZ 5 1 9 3 6 7 0 3 Jj 

tfz 6029373 Op] 6 2 1 2 0 0 3b 3 3 2 0 3|6 2 7!1 6 5 
2_3J9 8 9 sj7 1 7 5 |2 7 7 7 5|8jJ 2(7 9 4 4 2 3(6 0| 9 638 

6 5 9)6J9 5 9 I 4 1 4 5;5 4 4 0 5 5 5 9 Op 8 4 . . . . . . 

— - - ------ - — - - - * • : . , 

3) SZ 6 3 2 8 5 4 2 6; 

UZ 9 5 0 3 9 6 S{5}4 5 3 2 5 4p 9j9 8 5 7 9(7 2 8(7 3 2 6|6 9 

0 5jo 5 8|2 5 9 5 5 15 3|o 7 4 4 0 0i8|3 7 1 8 4 0 8;. a 8 . 

" ■'»**' I — 1 ■ -■ — - - » — -.1 . w i .i . 1 .. . II rj 

9) SZ 5153670 3? 6328 5426i 

UZ 6 0 2 9 3 7 3 0(3(9 5 0 3 9 6 8)2j6 2 1 2 0 0 3( 3 2(4 5 3 2 

5 4(0 8jfi 3 3 2 0 _ 3 } 6 5 6(5 8 5 7 9(4 8 6|l 6 5 2j|9 115 

7 3 2 6|3 2 4 7^7 1^7j|2 0 2 6 2 jo 5 S j 9 5 6 1 4^8 8 2)7 2 

2 8 8 2)5 3l7 4 1 7 5 2(6 0(9 9 4 0 6 0 7|s|o 1 5 8 2 7 8|6 

983466758163095 4(571702323 * . o . . 

10 a) SZ 3 9 6 2 4 0 2; 

t) 

UZ 258642 4.^7 3406 6_1'0 7 4 6 2 7 1 /7 1 0 8 9 8 8 !8 1 
5 7 7 6 6 ^9 9 5 4 3 2 5 !8 4 . * * . 

b) UZ 2 5 8 6 4 ^73406 ^9j0 7 4 6 5_9f 7 1 0 1 4 6 ;8 1 1 5 0 4 ^ ' 

9 26543 <181 ....... 

c) UZ 2 5 8 6 4 2jj7 3 4 0 6 £J?>0 7 4 6 3 9 2 I 7 1 0 9 2 1 9 :8 1 

9 .1 3 0.7 S 0__Q 4 3 7 6 

~" r r '* .■» - .I—..., , ..I — .1. ■ I ■ I I I w 

11) SZ 3 6 7 2 X 3 5 9 

UZ 9 3 5 X X 8 4 8(2 8 X X X 2 2 0|0 X X X X 4 2 ojx X X X X 6 

2 XjX X X X X 8 X Jfjx X X X X X X X 
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l ength of Russian additive with key: 


SZ, 

0 0 

0 1 


c 4 
0 5 
1 3 
4 2 


i» 

u z 

or a 



8 3141 
2 7 9 6J 


I3 4 3 7@7 7 4 l( 
• 1 6 7 3® 3 3 6 9( 


16 1 7 8(5)3 8 1 9< 
>4 9 3 2(|)7 2 9 Id 


48 2® 224 6® 662 3® 8 8 6 4JEJ4) 


»l 2 _ 2 JX. 

4718976392 

68 0 IX 


0-i.2_3_4 ! 56 2_8 1 


Length of Rue elan additive with 3-digit key ; 
0 0 0 0 0 0 }* 



<0 0 i | 


0 0 2 


FcT?) 


(01 1 1 2 2 3 4 
3 9(02 9 2 1 1 
66329514 
14155601 
51162789 
3 4® 7 4 7 1 1 


579261879564 1®5 
3 2 4 ^691 5 CO) 6 5 6 l'l 7 
65*50)151667239524 
617784^29716874 
5 7 4 2 1 6 3 7 90)6 9 6 5 5 
8 2 9(019 umbu : 


1566127 
2 8 9§7 9 7 
7 6 1 3 7 4® 

5 1 9 605 6 
lf0)6 16 7 7 


#2 2 2 4 4 6 8® 4 8 4 2 2 6 4 8® 2 8 2(® 2 

§ 3 1 3669253.76834175823 @5 3 5 8 8 3 6 1 
9 7 0 6763396 2 58735 #858331647 @171 
88967 *> 3285 03538816975 62183 9 12 0) 
3 2 3 5 5 8 O 38311425671384125 37 8® 5 8 
5 3 3 8 6 1 4 7 5 1 2 6 3 8 9 1 708 7 8 5 5 3 0 8 3 <3 1 1 
9 201 2 1 3 3 4 6 7®3 7 30:0 3 X 


£oTg @4 4 4 8 8 2 6-|8 6 8 4 4 2 8 
0 0 5 ® 5 5 

fOU 

G £2 




0 0 8 


@6 6 6 2 2 8 4® 2 4 2 6 6 8 2 4® 6 4 

0 7 7 744 1 8593427633528 7® 57522749 
1304347714852375 #25277946 3® 935 
? 2 1 4 3 \7 8 2 *>@7 j 7 2 2 9 4 1 3 5 4 8 9 2 ? 1 9 8 0) 
/ 8 7 5 5 20 7279968 543972698 CJ» 732052 
J Z7 249635984721 9 3&2 3 2 5 5 702 7 2 9 9 

1 8(9)9 8 9 7 7 6 4 307 3 7^ 7 X 

®8 8 8 6 6 4 2@6 2 6 8 8 4 6 208 2 8jgp) X 

carry forward 


Length 

1 

60 

20 

3 

12 


168 

24 


168 

24 

7 

24 


168 

24 

35 s 
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brought forward 608 


0 0 9 (0)9 998876531849231546 9® 59544963 
7 1 189978 t 6 5419 5(054 5 4 9 9 3 8 2 1#3 1 3 

447815^64 5<0>9 5944387158634973 60 
9 6 9 5 5 4 0. 3 4 9 3 3 2 6 5 8 1 3 9 4 2 3 6 5 9 1 4<@f5 4 
599483215368947 314 41455 9#49433 
7 6(03 639928 1® 91 9(g;oj9‘/ 

013 144 5 8937 20 92911 >5) 21233568149534 

87259746 1(07 178856319 403 4 3 7 7(04 7 
4 1 1 5 2 6 7 8 3.5 1 8 6 9 4 5 3 9 6 2 7§9 7 9 6 6 5 2 1 
7 3 8(0) 1 8 1 9 9(08 9 8 7 7 5 4 2 9 6 1 5 7 6 2 3 8 5 1 3 
6 4 9(0 3932254791 6 ( 9)7673 3® 63699584 
32759241657128 3@1 3 \ 

0 2 6 2 8 3§6 8 6 44@84 8 2 2f4 2 4 6 602 6j. 

124 3679362981798674317481293 1 2 ~4:>C 

2 4 8 6 |2fr8} \ 


168 


168 

24 

28 

4 

low 


£ 

J 

S 

£ 

7 

8 

? 



> XI 

I 

S/lXi/ ; \l^!71ry71/7bK 171 




XI7 ; JXl 

3ZLZZ 
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3» Additive sequences for codes with groups of varying length* 
t?ber3chlBsselungs2&hlen fOr wechselstellige Codes 
Since, when using additive, the danger lies in the fact that when 
the same additive is used several times the enciphered code group can be 
matched in columns and differenced, it is well to use the additive se- 
quence in connection with codes having groups of different lengths o This 
prevents differencing by columns the remainder of the text on the basis 
of single parallel passages because the varying length of the code groups 
does not permit dividing up the rest of the cipher tex t by groups. 

Hence if an additive sequence of adequate length, e*g* in the form of an 
additive book, is used in connection with a code which has groups of 
different lengths, then such an additive may be used for same time with- 
out hesitation if it is certain that the indicators will not allow the 
cryptanalyst to deduce the starting points for the additive* 
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Additive in the substitution table system., 

Me Oberschlgsselungszahl ;im Tauscht afelverf ahran ® 

Insofar as the additive sequence is to be used more than once there 
is another possibility present in the combination of the additive sequence 
and the substitution table® This combination represents a very essential 
improvement, insofar as solution by forming differences i3 out of the 
question even though the same additive is used a number of times® Since 
this system has first been used in France it is also termed the French 
additive system® 

As substitution table, it is well to use a square with 9 cells, i»e* 

3 rows and 3 columns® The digits 0 to 9 are entered in the square in 
random order leaving one digit outside the table to be used as a null® 

Such a table is shown at the top of sheet 1 of Appendix II B 4® Its 
use is as follows: 

1®) If the code value to be enciphered and the additive value are 
both contained in the square, then we take as cipher value that 
digit which with the two given digits forms a row, a column or 
a diagonal. The square is to be extended in all directions 
correspondingly® 

2., ) If the digit of the additive and the digit of the code coincide, 
then the null is taken as cipher value® 

3») If the digit of the additive or the digit of the code coincides 
with the null then the non-coinciding value i3 taken for the 
cipher- 

On sheet 2, three different texts have been enciphered by this sys- 
tem using the same additive sequence® The resulting message text corre- 
sponds outwardly to one which might have originated by using additive® 
Genuine parallel passages are possible in both cases only at the same 
point in the additive because like code groups at different points in 
the additive cannot appear as parallel passages., 

54 

TOP SECRET 


Doc ID: 6592460 


\ 


TOP SECRET 


For instance, although columns I and V each contain the two code 
groups 32750 and 16278, the corresponding cipher groups 57404 and 60337 
or 16055 and 32876 no longer give any suggestion that like code groups 
are involved because differencing does not work. 

Since the unauthorized decrypter has to rely solely on repetitions 
in the cipher text, the same additive sequence may be used with the 
same substitution table just as long as the repeats, whether within the 
columns or between the columns, give no clues .for decryption. This 
means, however, that even with heavy traffic all messages for one day or 
even longer might be enciphered with the same material. Even assuming 
that the basic code is known, there would still be absolute security. 
Since the superencipherment consists of two parts of equal value, namely 
the additive and the substitution table, the loss or compromise of one 
of these factors would not necessarily compromise the day’s traffic. 
Consequently the combination of code, additive sequence and substi- 
tution table affords extraordinary security. 

We have now covered all essentials of superencipherments and com- 
bined systems,. Other combinations and other superenciphements are 
conceivable, to be sure, but it is quite certain that new points of view 
would appear which have not already been touched on, 
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Substitution table 


i 3 


6 

0 

4 

(0 

O 

c 

y 

2 

5 

a 

SL 

S’ 

% 

9 

7 

1 

? 

7 

/ 


Consists of one null (red) and nine single digit values which are arranged 
at random in a 3 x 3 square. Its effect corresponds to that of the following 
substitution table: 



0 

1 

; 2 

3 

, 4 

5 

6 

7 

8 

9 

0 

W\ 

it 2 

1 

0 

6 

7 

4 

5 

9 

8 

1 

2 


0 

t 

Jk. 

! 

* 

8 

6 

5 

9 

4 

7 

2 

1 

' 0 

•i:3i 

i ? 

7 

8 

9 

4 

5 

6 

3 

0 

i 1 

;3 

3 3 ' I 
:\ 

4 

5 

6 

7 

8 

9 

4 

6 

1 8 

1 

7 

4 

;si 

9 

>*v 

0 

r * • 

2 

1 

5 

5 

7 

i 6 

i 

8 

s I 

9 

i!>: 

i 1 

0 

2 

4 

6 

4 

5 

9 


0 

1 

lij! lj! 

1:13)! 

j 8 

7 

2 

7 

5 

9 

4 

•7 ! 

• i 

i 

2 

0 

8 

IN': 

6 

1 

8 

9 

* 

5 

8 ‘ 

1 

2 

7 

6 f 

j'i; v 

0 

9 

8 : 

7 

6 

1 

9 

5 

4 

2 

1 

0 > 

ji 3 ' 


The substitution table contains, once the null is determined: 

28 constant substitution values, and 

72 variable substitution values, which can be reduced 

to 12 different basic equations (if, for instance, 

01 - 2, then 10 - 2, 02 = 1, 20 - 1, 12 « 0, 21 = 0) o 

act 

It yields — possibilities 0 
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Encipherment 

sequence 


Cod© text A 
Cipher text A 


Code text B 
C&pher text B 


Code text C 


8 


12 3 4 


5 4 2 7 6 


3 2 7 5 0 

5Tm 


1 627. 8 02486 

T'O 3 3 7 3 * '• 3 6 ; 



0 3 4 3 1 



0 2 4 8 6 

3 2 3 8 3 


1 5 4 2 9 


3-2X10 


5 6 7 8 9 


320546332419537 


5 9 6 7 0 
5 6 4 0 6 


6 8 3 0 6 
3 8 8 1 0 


3275019502 

3353659217 


2 8 9 1 6 


8 7 6 4 2 


I 


VI 


§123456789 

4 5 9 6~2 


• • -»-»r • »,« ' h* 


0|1 9 5 0 2 
15 5i 


1 6 2 7 8 |2 2 5 8 1 
3287678470 


Cipher text C 6 9 7 4 2 

0 2 2 5 

2 2 

5 8 6 0 

7 7 7 7 7teNfl 3 0^ 

Cipher 

0 ® 

03 

12 

21 

30 

46 

57 

64 

75 

69 

93 

ft 

1 ® 

02 

13 

20 

31 

48 

56 

65 

79 

84 

97 

ft 

2 = 

01 

10 

23 

32 

47 

58 

69 

74 

85 

96 

ft 

3 = 

00 

11 

22 

33 

44 

55 

66 

77 

88 

99 

n 

4 “ 

06 

18 

27 

34 

43 

59 

60 

72 

a 

95 

ft 

5 « 

07 

16 

28 

35 

49 

53 

61 

70 

82 

94 

ft 

6 «» 

04 

15 

29 

36 

40 

51 

63 

78 

87 

92 

n 

7 - 

05 

19 

24 

37 

42 

50 

68 

73 

86 

91 

n 

8 a 

09 

14 

25 

38 

41 

52 

67 

76 

83 

90 

t? 

9 

08 

17 

26 

39 

45 

54 

62 

71 

80 

93 


3273511 9 502 

0 .** 2/t A . 
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CHARACTERISTICS j, ANALYSIS AND SECURITY 
OP CRYPTOGRAPHIC SYSTEMS 


lo Attached is an Amsd Forces Security Agency translation of 
Parts III and IV of a treatise on oryptology prepared by Dr« Bruno 
KRSgE^ s formerly with the Porschungaamt ., German titles SyateicatiRn 
Analyse und Sloherheit der Gehedmachriften o 


2o This treatise purports to cover in detail the work given in 
the course at the Forschungsamt » Since the methods described here 
are not essentially different from those used by AF8A S the primary 
value will be found in the picture it gives of the approach to these 
problems of another major cryptologic unito 
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PART HI 

cipher Machines' 

( CMFFRIEE^CHIHSBn 

That cipher machines are not taken up until the treatment of all 

i ^ 

substitution and transposition systems and of all combined and super- 
enciphered systems has been concluded- is due to the fact that cipher 
machines in their characteristics .dp not differ from the manual systems 0 
The reason for treating them in a separate part is that a discussion 
of the technical peculiarities of eaoh cipher machine is necessary be- 
fore we attempt to apply the basic knowledge already gained from the 
manual systems 0 

It is s common characteristic of all the cipher machines treated 
in the following pages that they must all be regarded as polyalphabetic 
substitutions since, when enciphering continuous plain text, each 
element is enciphered with a different alphabet 0 These alphabets al= 
ways have a definite connection with one another which can be explained 
by the construction of the machine* Moreover the sequence in which 
these alphabets are used is to be regarded as the- egression of a sys- 
tematic character inherent in the construction of the machine* 

Therefore the only thing ;that is new in the study of cipher mach- 
ines nay be the inner connection existing between the individual cipher 
alphabets insofar as a parallel to their structure and sequence may not 

always be found among the manual systems* 

^ ^ , *•*•.*■ . • ♦ # 

Since the different cipher machines that have been developed in 
different countries have no essential relation to one another, the order 
in which they are taken up can be an arbitrary one* 
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SECTION A 

GOTA1 CIPHER MACHINES 
( DEUTSCHE CHIFFRIBRMA3CHIHM ) 

Sine® the writer’® professional concern with the security of Ger- 
man cipher machines was limited to cases where these machines were 
also used by foreign countries s the . treatment of certain Gersan mach- 
ines will have to be limited to basic considerations because tech- 
nical details are not always known to him# 

1« The Enigiga cipher machine® •’ * 

Die Enitma-Chiffpiermaschlne . 

Three different types of Enigaai machines were developed® The 
basic type, fra® mhioh the other two were derived later, is the Enigma 
cipher machine Type K® 

The construction and functioning of Enigma Type K is assumed to be 
known® It has been represented schematically fcy a paper device shown 
in Appendix IQ A l a, sheet 1®* Using this paper device sfoy^oipher 
test can be produced just- as well as with the machine, provided the 
wheel wiring Corresponds® 

In Appendix III Al a, sheet 1, the column of letters at the right 
side corresponds to a fixed disk in the original machine which lies at 
the right of the right hand movable wheel® This disk in the machine 
is connected both with the keyboard and with the light bulbs under the 
letter panel in the sequence of this column, hence in what follows 
this column is designated as the endplate • sequence® 

Th® paper strips I, II and III represent the wheels which may be 
placed in positions A, B and C according to the wheel order selected® 
The outer number sequences from 1 to 26 at the right and left on each 
strip correspond to the 26 points of entry and exit cm each wheel® 

* This study of the Eni g m a Type K was submitted earlier as a sample of 
what KrSger planned to do and was Issued as DF 240 B® 
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We designate as point 1 that point o f each Wheel at which the letter 
sings are set* The inner number sequences indicate the wiring within 
a wheels the numbers of these inner sequences indicate the point on 
the opposite side of the wheel to which the point of entry or exit 

is connectedo . She two columns of numbers standing on the left side of 

' ■ _ . _ ; , ■ ■ . ‘ • ( 

the paper device correspond to the reversing wheel or mirror in a 

definite position and with a given wiring* 

The sequences of letters in the center of the strips represent 
the setting rings on the wheels in a particular settingo The lines 
between the letters m and n on wheel X* f and g on wheel II a y and 

t 

z on wheel X3X are to indicate the notches on the setting ring 
which the stepping levers (Indio at ©d by an arrow on the paper device) 
engage when the wheel reaches the appropriate point and which thus 
cause the stepping of the middle or left wheel. The hatched squares 
on the lowest row (on a level with q of the input alphabet) are in- 
tended to represent the windows in which the window setting of the 
wheelsie visible* 

With this paper device* using an arbitrary wheel order X* IH* II* 
an internal ring setting v on wheel I* 1 on wheel XI and h on wheel in 
and with the outer window setting n c f for the three wheels* all ci- 
pher values for the plain letters of the endplate sequence have been 
developed in 26 successive positions of the right hand wheel and these 
are shown in Appendix III A 1 a, sheet 2o. The first twenty-one of 
the resulting alphabets have been separated fro® the last five by a 
vertical stroke because at this point the middle wheel made a step* 
Therefor© the cemplext reversing wheel* wheel 1 and wheel 111 which 
forms a reversing mirror* changed at this point o 

The following description of the regularities of the cipher text 
of the Enigpa Type K is based oh the fundamental idea that the re- 
versing wheel* left wheel and middle wheel form a constant during the 
encipherment of 26 letters which lie between the steps of the middle 
wheel. The encipherment of 26 successive letters is therefore based 
solely an: 
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. 1® The wheel firing of the right wheel, and 
2® of the mirror complex composed of the reversing 
* wheel, the left wheel and 1 the middle wheel® 

The purpose of the following discussion is therefore to develop 
the cipher text following Appendix III Ala, sheet 2, in such fash- 
ion that the regularities inherent in the wiring of the right wheel 
and in the' reversing mirror became recognizable® 

For this purpose the alphabets in 'Appendix III A 1 a, sheet 2, ' 
have been converted, into numerical values on sheet 3 in such mann er 
that the letters q to m have been converted into the input values 
21 to 20 valid with the initial setting f of the right hand wheel® 

In Appendix III- Ala, sheet 4, 1 has been added to the numeri- 
cal values of the second alphabet ( i.e®, of the second vertical 
column of numbers) shown on sheet 3, 2 to those of alphabet 3, 3 to 
those of alphabet 4, etc®, thus transforming all cipher letters of 
Appendix III A 1 a, sheet 1, into the input values of this wheel for 
the momentary position of the right wheel® This transformation 
causes the substitution* values of III Ala, sheet 1, to be reduced 
to a uniform denominator independent of the movement of the right 
wheel® 

On sheet 4 the numerical substitution values standing in the 
diagonals running down from left to right have been formed by the 
same wheel wiring leading from the endplate alphabet to the rever- 
sing mirror® 

, These diagonals have been taken out and arranged horizontally on 
sheet 5® Closer examination shows that these sequences are similar 
in’ pattern, as is revealed by a comparison of diagonal 7 and di- 
agonal 6® Here the isomorphic relationship of each row with any 
other row is revealed, displaced in each case by value to the 
right® The values found in these diagonals always have the same 
wheel wiring in the path from the endplate alphabet to the reversing 
wheel (lying between the middle and right hand wheel) and therefore 

' 8 

- TOP SECRET 


Doc ID: 6592463 


TOP SECRET- 


use successively all mirror wirings of the reversing complex. corred- 
ponding to the progress of the right wheel,, The isomorphism between 

‘ ft. 

the diagonals is therefore merely a reflection of the reversing wheel 
valid for the right hand wheel* 

To explain this we have shown in Sheet 6: 

1* A reversing mirror valid for the right wheel with the win- 
dow setting n c f as it is formed by the complex* reverse 
ing wheels wheel i and wheel IHs * 

2 0 The same reversing complex expressed in the difference 
values between the contacts* ( Schaltpunkt en ) * 

3* Two different diagonals from sheet 5 at the level corres- 
ponding to the reversing complex* 

v* . . * 

The isomorphic relationship of the diagonals to the reversing complex 
expressed in differences thus becomes * obvious * / 

Now if all the diagonals are arranged according to their iso- 
morphic relationship to the reversing complex,, as has been done on 
Sheet 7 and sheet 8a (in this case with the displacement of 1)$ it 
appears from sheet 8 that with this arrangement all the veriica.' 
columns of numbers as well as the number sequence of the diagonals are 
no more than a reflection of the wheel wiring of the right wheel as 
contained in the inner left column of wheel II in Appendix III A 1 a* 
sheet 1*. 

With this we have shown that by converting the plain and cipher 
letters into corresponding numerical values of the endplate sequence 
the wheel wiring of Enigma Type K can be reconstructed* This possi- 
bility of reconstruction depends on the systematic derivation of 26 
successive alphabets by turning one wheel while the other .wheels, 
remain still* 

On the basis of the regularities just disclosed we find the 
following possibilities for solving Enigma Type Ks 
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Possibility A« 

We assume as known three successive alphabets which have been 
obtained, let us eay p by solving several messages in the same key 
or in some other fashion® , 

These alphabets are converted in the manner indicated above into 
numerical values and written out on stripe corresponding to the rows 
of Appendix III Ala, Sheet 8® We shall use as an example the first 
three alphabets from the previous example after the stepping of the 
middle wheel, i«e 0p alphabets 16 to 18 on Sheet 4 as they appear on 
Sheet 8e This gives us the following strips? 


1 

20 

13 

24 

10 

15 

4 

5; 

19 

23 

6 

25 

T 

8 

9 

6 

TL 

18 

23 

4 

55 

1 

3 

6 

X 

9 

20 

14 

35 

22 

15 

13 

2l 

7 

8 

22 

T* 

6 

10 

11 

S 

, 19 

1 

12 

55 

22 

18 

21 

? 

24 

25 

10 


5 

24 

3 

55 

26 

IX 

7 

5 

4 

19 

20 

B 

10 

12 

16 

5 5 

26 

14 

1 

2 

21 

17 

23 

35 

24 

26 . 

15 

25 

17 

5 

19 

8 

2 

21 

2 

17 

25 

7 

18 

55 

23 

16 

9 

2 

3 

2 

26 

I§ 

11 

22 

17 

27 





Starting with any strip, the other strips are matched with it 
successively until it can be dedueed from the juxtaposition whether 
the selected strip or wheel wire sequence is correct or not® First we 
shall assume that initial strip 12 As :i followed by strip 38® 

12 25 7 18 

18 11 22 18. 

The columns 7 11 and 18 22 resulting from this superimposition 
signify, according to the regularities set forth on- page 8 that 1 with an 
assumed wiring sequence ( Walgenschaltungafolge ) 17 18 w© get also 
the sequences 7 11 and 18 22® If the strips corresponding to these 
sequences are superimposed and inferences are drawn, we get the 
following® 

lo) 2 21 17 13 18 B 22 17 

U 18 23 4 22 12 .18 21 

Since this would give us the new sequence 23 23 » which is Impossible, 
we have proved that the assumed sequence 17 18 was false® . 
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Wo next make the aasTsaptloa that strip 12 is f ©Hosed by strip 
a*. This yiolde the followings 


lo) 

42 

25 

7 

1 S' 









22 

:i3 

6 

25 ;• 






2a) 

1 

21 

17 

23 

i 

4§ ; 

n 

22 

17 



; , 

42 

19 

1 

12 

6 


4 

19 

20 

3o) 

24 

25 

11 

7 


22- ■ 

32 

IB 

21 




1 

20 

33 

24;;/ / 

■ ” &•; 


6 

10 

11 

4t) 

44 

18 

23 

4 


a 

.7 

3 

22 




20 

1 

3 

6 

{ * ' * . ; • 

42 


15 

4 

5 

5®) 

k 

6 

10 

11 

* * * 

• l ** 

8 

2 

21 

2 




4 

9 

20 

34 

44 


10 

12 

16 

6.) 

10 

15 

4 

5 

• . ■ 

■ s 

8 

9 

8 





3 

2 

26 

42 


22 

15 

13 

70 

1 

14 

25 

10 

y* y .** 

2 

3 

2 

26 




. t 

8 

9 

8 

22 


12 

18 

21 

8* ) 

2£ 

17 

5 

19 


<£© 

23 

16 

9 





2 

21 

2 

£8 

• • 

11 

22 

17 

%) 

42 

33 

6 

25 


16 

24 

26 

15 




gi 

7 

8 

22 

n 


18 

23 

4 

10o) 

6 

4 

19 

20 


44 

10 

12 

16 




2 

21 

17 

23 

24 


26 

11 

7 

lib ) 

22 


3 

. 6 


12 

22 

15 

13 




42 

25 

7 

18 

2k 


23 

16 

9 

12o) * 

,4 

9 

20 

14 


44 V 

19 

1 

12 




as 

17 

5 

19 

16 


24 

26 

15 

13*) 

Ik 

5 

24 

3 


l 

20 

13 

24 




4 

14 

25 

10 ' 

~ 2k 


16 

34 

i 

14*) 

2k 

16 

34 

1 









14 

5 

24 

3 r 







From those fragments w© get the entire wheel wiring of the right wheel 
as follows* • - 

17 19 21 10 9 22 4 3 25 8 15 23 1 24 34 5 2 12 
26 18 6 7 13 16 11 20 17, 

This asaaple likewise shows that a minimam of three alphabets is 
adequate for the recovery of the wheel wiring® (However,, if the re- 
versing complex for the alphabets concerned has two successive parallel 
wirings at the same intervals then -a fourth alphabet ' will be necessary 
in order to recover the complete wiring sequence 0 
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Otherwise we shall gat several ffcagtosots which contain no contra- 
dictions, but it will be necessary to test out the correct oombina- 

’ * i 

ticaa with the cipher text^ With tlie wiring of the right wheel thus 
obtained we can for the moment holy produce a wheel which is equi- 
valent in its effect, since from the wiring sequence itself the 

* f ‘ 

points on the left side of the wheel to which it is to be aasooi- 
ated are not evident* Henoei iwe have to sake an arbitrary assump- 
tion which yields one of the 26 possible wheels which have the same 
effect* Which of the 26 represents the original wheel can only be 

* ” r * 1 * I 

determined after reconstructing! the remaining wheels* 

• I . 

For reconstruction of the middle- wheel it is necessary to have 

■ { * ■ • t 

three alphabets at an interval of 26 which are used as in the above 
example* The requisite three alphabets at an interval of 26 can be 
picked out of the traffic fairly easily* Here the procedure is to 
associate to the cipher test an assumed plain test (frequent tele- 
gram beginnings or some word which may be expected to occur in the 
test because of the link or of contemporary events ) so that for each 
possible Juxtaposition of plain text with cipher test (with the al- 
ready recovered wheel) mirror connections are produoed which result 
from the 26 possible initial positions of the wheel and the input 
alphabet* If contradictions appear In the mirror connections, that 
means that the assumed word cannot stand at that particular point 
with the assumed Initial wheel position* If no contradictions re- 
sult, the mirror connections obtained are used to get new plain text 
letters to the right said left in' the passage of cipher text 0 If 
these can be extended to yield reasonable text and if the extension 
confimd the mirror connections already obtained, then the accuracy 
of the assumption, is proved* After that it is merely a question of 
expanding the test beyond those points where the middle wheel steps 
and of continuing to expand the text on the basis of the newly ob- 
tained connections of the new mirror complex until some 60 to 80 

I 

letters of plain text are available with associated cipher text* 
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Then by recovering the input alphabet for the middle wheel it is 
possible to fora three alphabets at an interval of 26 which will 

psrait areocnstraotion of a middle wheel having the same effect as the 

* ‘ 

original* 

The third wheel oan be recovered in the same manner by using a ci- 
pher test where this third wheel is in the middle position o 

From the equivalent wheels thus obtained it is possible to recover 
the original wheels if the window setting of three cipher texts which 
have been solved, is known?: provided each of the wheels I, II, and XU 

■' - ' J . * ’ . . v ‘ 

occupies the right hand position in one of the messages o From the 
window setting and the stepping of the middle wheel it can be deter- 
mined which of the three wheels corresponds to the original wheel l s 
II or XXIo The right side of the wheel is then brought up to the 
original values by adding some number between 0 and 25» With the aid 
of the solved text, the left sides are also brought into the original 
setting by turning the wiring aequenoe to that position where the 

• i * ' • c 

different wheels function correctly together «. 

When the keys are sent in clear or are known,, any message can be 
read by setting the inner and outer key as would be done at the re- 
ceiving station* 

Xf only the plain window setting is known while the inner wheel 
setting is not known but remains constant for a definite period of 
time, solution of one telegram by means of a crib is enough to ena- 
ble reading all the other messages of that period* 

On the other hand, if the inner and outer settings are not 
known, then for each individual message it will be necessary to force 
an entry by trying a probable word* This takes a lot of time then 
done by hands it is quite possible to produce auxiliary machines 
working with electric relays by the aid of which a speedier break 
into almost every message becomes possible* 

Possibility B s W© assume as known a so-called compromieed text, 
.ioSo, a cipher text which has been compromised because the plain text 
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has become known* Thle compromised text must have a length of 62 to 

; t . . 

65 1st tore, depending on the position of the steps of the middle wheal* 
The substitution ‘Baines obtained from the plain text and cipher test 
are transformed into numerical raises by the method described on 
pages 8 and 10 , .and written out on strips* In contrast to the 
strips ©f 3* , esll width used for the reconstruction of the wheel wiring 

under Possibility A. the strips used here are of a width corresponding 

. » ‘ < 

to the length of the test and have only scattered substitution values 
on them* Me now employ these strips very much as we did those des- 
cribed in the Poealb^lity A- with the sole difference that in addition 
to an original assumption regarding the wiring sequence we have to 
make a 2nd., 3rd, 4th or even a 5th assumption before it is possible 
to determine whether the assumptions made were correct or not. This 

* i 

would work out somewhat as follows s 

If the first assumption of a sequence 1 2 yields no olue regarding'', 
another resulting sequence, or if a resulting new sequence leads to 
no conclusion regarding the correctness of the first assumption, it is 
expanded by a second assertion of a wheel wiring sequence 1 2 £ or 
even 1 2 i.e», we keep making a new assumption until the possi- 

bility of this assumption is eliminated lay resulting contradictions. 

The process is, continued until by the elimination of the impossible 
Wheel wiring sequences the correct sequence is found where no contra- 
diction occurs. 

If the original window settings for the compromised test employed 

■ * 

are not known, this work is rendered store difficult by the fact that 
we have to guess the positions in the test where the middle wheel 
stepped^; Hence we have to assume the step for all positions at an 
interval of 26 because superimposed substitution values on two strips 
only lead to correct deductions regarding other Sequences when they 
have been produced with the same setting of the middle wheel. 

To give seme idea of the extent of this labor, it may be stated 
that the reconstruction of the first wheel by this method can be 
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acccmplished by five or six workers lx fmn on© to six weeks, de- 
pending on whether on© stumbles on the original sequence early or 
late in the process* 

The reconstruction of the two remaining wheels can then be 
accompli shod relatively quickly in the manner described under Possi- 
bility A o 

Since the wheel wirings are soldered, no daily change in wiring 
is possibles Prom the standpoint of security it is necessary, there- 
fore, to demand that this system be Incapable of solution by the un- 
authorised cryptanalyst even when the system as such is known, i«e«, 
in the present case when it must be assumed that the machine and 
wheel wiring are known* The Enigoa Type E by no means satisfies any 
such security requirements, as is apparent from the preceding, be- 
cause a single correctly guessed word leads to the solution of the 
message e Proper handling ©f the keys can at most make it nscessajyto 
solve each message individually but can never make solution of tele- 
grams impossibles. If special auxiliary devices are used for decipher- 
ment, no essential delay in reading can be assured. Even a frequent 
change of wheel wiring will not satis^r the security requirement a o 
That we are not talking of exaggerated demands for security will be 
shown by the supplemental remarks in Part IV, Section C of this report* 
The principle of encipherment by rotors, which is good in and of 
itself, would only yield adequate security if the machines were com- 
pletely redesigned* The basic requirements for such redesign would be* 
1* The regular wheel stepping must become very irregular and be 
capable of setting by some appropriate device* 

21 The reversing combinations must be easily varied by appropri- 
ate devices * 

3* The input alphabet must be capable of variation by plug . 

connections between the keyboard and the input plate* 

4* The reciprocal character of the .alphabets generated must be 
don© away with* 

In any event there is no possibility of using the Enigma Typ© K in it® 
present state so as to satisfy security requirements* 
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Of course there would be a possibility ©f reenciphering the cipher 
text bgr the nsachin© or the plain test could be enciphered by another 
system and then reenciphered with the Enigma® However, this would 
never be satisfactory because encipherment and decipherment would take 
too much time and simple manual systems would afford greater security 
and faster work 0 

Enigma Type 0 

To sake it impossible for the unauthorized cryptanalyst to follow 

, % 

the course of solution just described, the regular stepping of the 

* * ! 

wheel was abolished in the nest type, the Enigna Type Go This was 
accomplished by providing the setting rings not merely with one notch 
but with a considerable number of notches distributed at irregular 

w , 

intervals on the rlngo Since these notches cause the stepping of the 
middle and left hand wheel, this results in an irregular stepping of * 
those wheels o Consequently the complex; middle wheel, left wheel and 
reversing wheel changes at short irregular intervals 0 

This means that the method of wheel recovery used for K is no 
longer usefttlo 

On the other hand, the total period of the machine can be shortened, 
depending on the arrangement of the notches, so that with heavy use of 
a specific wheel-wiring and a specific wheel sequence it might be 
possible to reach a solution of the original columnar alphabets on 
the basis of parallel passages including digraphs and single cipher 
values for the most common plain, values by lining up enough cipher texts 0 
This danger might have been countered easily by supplying a set of, 
let us say, ten wheels instead of the usual three® Three wheels would 
then be selected from among the ten and placed in the machine according 
to a frequently changing key® This would not merely result in consi- 
derably lengthening the total period of the machine but would at the 
same time have raised the number of sequences for the wheel positions 
from the former 3? a 6 to 101 e over 3a nri lllano 
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As a result* the difficulty 4 b changing the wheel wirings end the 
sequence of the notches* which remain constant for each wheel in spit© 
of their irregularity* would play a- far less important role in respect 
to the resultant decrease in security o 

It seems incomprehensible that the development in this essentially 
favorable direction was started but was broken off prematurely* 

Axtmr Eftygia 

In any case the Sed@ai most widely used in Germany » the Army 
Enigna cipher machine,, gave up entirely $he advantage ofiirregular 
stepping* Moreover it dispensed with the movable reversing wheel so 
that only, three windows were provided for the external wheel setting* 
Instead,, the A ray Enigma was improved to the extant that the pre- 
viously fixed connections between the key-board and the fixed disk 
of the input alphabet were made pluggable* not at will* to be euro* 
but at least by pairs of letters* Thus if the key p was connected 
with input point sui instead of with ihe input point p* key x was con- 
nected with input point p« ; ' ■ 

The resultirig regularity in the plug connections* inaccasnection 
with the reciprocal character of the machine led* in some way not 
known to me in detail* to a possibility of solution of a single mes- 
sage as soon as it contains more than 500 letters of continuous test 
provided the internal wheel wirings are assumed to be known* 

Essential for recognising the existing plug connections is a count of 
the cipher text in a square 26 x 26 corresponding to the 26 position© 
of the wheels during one revolution and to the 26 cipher element So 

This count showed along the diagonals a mirror like structure so that 

j ' . ■ 

a heavy score in cell ib generally corresponds to a heavy score ini 
the cell bio The more heavily scored cells aro a consequence of the 
plug connection and indicate which letters were substituted through 
the plug board* After solving the ping connections the rest of the 
solution may be accomplished by the same methods as were described 
for Enigma Type S* 
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Appendix T ' 
Enigma * 
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X 
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20 

21 
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17 

12 
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h 

21 

20 
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f 

10 

11 
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V 
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g 

16 

19 
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e 

2 

10 
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u 
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1 

18 
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d 

19 

9 

13 18 

t 
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a 

14 

17 
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e 

9 

8 
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a 

22 

12 
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d 

19 

16 
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b 

20 

7 

11 8 

r 

26 

11 
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c 

5 

15 

6 4 
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16 
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q 
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Appendix III A 1 
Enigma Type K 
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Appendix III A 1 a £ Sheet 3 
Enigma Type H 
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2o The Siemens Cipher Teleprinters 

Me Sie^nB-^heiJ^Fern8chreltapaschinen 

The construction and functioning of the Siemens Cipher Teleprin- 
ters is likewise assumed to be known „ Encipherment is based on the 
following principle i 

32 plain elemente^in all are converted into five t and <=* signs 
of the baudot alphabet* These signs non first over five wheels, 
which according to their camppattern cause a transposition of the 
signs, and then over five other wheels which according to the cam 
pattern either convert the already transposed signs into their op- 
posite or leave them without further change* Henoe we have a com- 
bination of transpositions and substitutions* Expressed in the form 
of a diagram we get: 



The plain signs or impulses 1 2 3 4 5, which in the above diagram read 
- — * 4- are shifted at the point marked U corresponding to the 
existing cam pattern to - +-•{■ - - and at the point marked E are either 
left unchanged if they coinoide with the sigh of the second set of 
five wheels, or are replaced by the opposite sign, if unlike signs 
come together* 

The possibilities of solution depend on the following consideration: 

The baudot alphabet from the point of view of cryptography is by 
no means calculated to equalise the frequency of the or - impulses 
In the first to fifth positions, having regard for the frequencies 
of the plain language,, On the contrary, for practical reasons it is 
so constructed that the most frequent plain letters show the least 
number of plus impulses* 
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Consequently by taking into consideration the frequencies of the 
plain language it is possible to calculate what percent of .plus .im- 
pulses and minus impulses appear in the first to fifth positions©,. 

It is also necessary to ascertain which switches at position 0 
on the diagram correspond to the 32 possible combinations of cam 
crest and cam trough ©n the five wheels of the oipher teleprinter 
SFM 52 Type ab© 

From these two basic computations. It is then possible to compute 

how the minus impulses of level 1 are conducted through the various 

i ' • 

switch arrangements to levels 1 to 5. If this computation is then 
carried out for levels 2 to 5, then we know the percentage of plus and 
minus impulses to be expected for each individual level at position So 
If it turns out that at position .E some 60 percent minus impulses and 
40 percent plus impulses enter oh the average, it can be deduced from 
that that the first impulse of the cipher test, if superimposed in 
ten columns corresponding to the "length® of the ten wheels, must 
neoessarlly give a reflection of the wheel in question in one of these 
ten cases (namely when the column width of the test and the pattern 
(Ugfang) of the wheel active at that point in the diagram agree) 
whereby the crest or trough and the predominance of minus or plus 
impulses must correspond,, 

Since the cams on the wheels of the SFM 52 Type Si/b. are not setta- 

; • i . 

ble i.e© 9 are invariable, it is necessary when. testing the security of 
the machine to start with the assumption that the wheels are known to 
the unauthorised cryptanalyst* . 

Consequently a comparison of the above texts written out in 
various column widths, with , the cam patterns of the wheels can show 
which five wheels are active at position E and what their initial 
setting is* Using these wheels the cipher text can be converted into 
an intermediate text which differs from the plain text only by the 
transposition ( iteetellung )* 
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A comparison of the intermediate test, bitten down according to’ 

i • „ * . ; . 

the patterns Of the five remaining wheels* with the other five wheels 
leads to the solution of the plain test if we consider the plain ele- 
ments arisingo 

Instead of computing the probabilities for the distribution of 

v * * ♦ 

pine and mines Impulses* the necess&xy preliminary work may be done 
by studying a plain text of suffioient length* say 10*000 letters* to 

determine the distribution of the Impulses at different points in 

* - 

the diagram,, 

, t# , % 

Hie effect of the regularities inherent in the machine on the one 
hand* and of the regularities resulting from the plain text frequen- 
cies in conjunction with the baudot alphabet on the other hand* is 
so strong that a cipher text produced by the SFK 52 Type ab can be 
worked on with good prospect of success if it is 500 elements in 
length*. 

Much more simple is the solution of the SFM 52 Type <c« This new 
type* supposedly developed as an improvement on Type a/i differs 
essentially only in the Wirings effective at point U of the diagram 
as these are activated by the cam pattern of the wheels involved* 

In the supposed improvement one factor was overlooked* namely how 
these new wirings would affect the cipher text* Sven a simple study 
to see which cipher values can occur in enciphering a given letter 
would have shown that from one plain, letter we cannot get all 32 
possible cipher values but that only 16 different letters are possible 

as encipherment for any plain letter* Further experiments of this 

■ * " . ■ ** 

sort would have shown that* due to jocularities in the wiring found 
in Type 6, the 32 letters fall into two separate cycles* and a plain 
value from one cycle can only be enciphered by values from the same 
cycle* 

Since about 15 letters of continuous enciphered text with known 
plain text will suffice for computing the setting of the machine* there 

is a much simpler method of solution for the Type do 
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This consists in converting the supposed plain text passage of this 

' / . . 1 

length (crib) and the cipher test itseif into the digits 1 and 2 S 
according to the cycle to which the letter involved belongs* A 
comparison of the assumed plain text thus converted into digits with 
the cipher text shows whether and in what position this assumption 
may fit* Further computation then shows whether the assumption is 
correot or not* 

The Siemens Cipher Teleprinters were capable of solution then 
because *• 

1* Both Types a/b and Type c use wheels with fixed cam patterns 
which cannot be varied; 

2* The wheel stepping is absolutely uniform in both types so 
that the cipher text can be written out on widths corree 
spending to the lengths of the wheels; 

3* The Baudot alphabet with its distribution of plus and minus 
impulses is used rather than some special alphabet which would 
correspond to cryptologic demands; 

’ i ’ 

4* The internal wiring of Type c was poorly chosen* 

Due to the combination of all these defects it £ was not possible for 
the essentially sound principle of combining substitution and trans- 
position within the polyalphabetic substitutions to realise its 
advantages* 

The two types & and £ represent an emergency solution which had 
to be adopted when it appeared that the existing types could not meet 
security demands* Since one could not think of a new construction 
under the circumstances* the only thing left was a reconstruction of 
i the existing devices and possible improvements were greatly limited 
by technical restrictions. 

The improvements consisted ultimately only in the introduction of 
a supplemental device which changed the hitherto regular wheel step- 
ping through the Interaction of the wheels* Ey the installation of 
this supplemental device Type a/b became Type d and Type c' became 

Type e getting a new wiring at the same time* 
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No final investigation of the degree of security thus obtained 
was ever made* 

3« The Aray Supplemental Devioeo 

The last of the cipher machines used by the German Armed Forces 
■Bias, the so-called A ray Supplemental Device T 42, details of which 
never became known to the writer The cipher part of the device was 
combined with a punched tape printed to which the cipher text was 
transferred# For transmitting the punched tape plain teleprinters 
could be us ©do 

The possibility of solution again lay in the fact that the 
supplemental device 5 like the Enigma and the Siemens Cipher Teleprinters 9 
used only fixed parts which could not be. set at mil# 


* The translator also has no further information# 
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SECTIOH B 

NOM-GEHMM CIPHER MACHINES 


While all Goman cipher machines suffered from the serious de- 
fect that the individual parts which accomplished the encipherment 
were rigid, hence were not settable, and that the stepping of the 
machines was regular, most of the non-German manufacturers succeeded 
in ^overcoming these defects in the course of time by further 
development® 

1, The Japanese Cither Machine . 

The construction and functioning of the Japanese cipher machine 
never became known to the German cryptologists, nor was it ever 
possible to learn from the cipher test with any high degree of proba- 
bility how the machine must have been constructed® 

From a standpoint of characteristics this machine occupies a 
special position since it is the only one known which is based upon 
the principle of the short slide. Actually several 2-part slides 
are involved which are arranged one after the other, one part origi- 
nal ly had only the twenty consonants and the other part only the 
six vowels® The machine passed through several stages of development, 
some so related that a new stage of development often could only be 
recognised after the next had been reached® The fact that several 
2-part slides must have been arranged one after the other was not 
recognized until late, because - for practical purposes - a single 
2-part slide would have the same effect. The letters on the slides 
could be inscribed in any desired sequence® 

In the first development stage the plain sequences of both 
partial slides are displaced one letter with respect to the cipher 
smjuenoe after enciphering an element. Consequently, what we have is 
a columnar polyalphabetic substitution ( SnaltencSsar ) corresponding 
to the Tritheim table. Solution is possible on the basis of iso- 
morphic passages in the oipher text® 
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It Is greatly facilitated by the appearance of stereotype message 
beginnings o The Japanese characters are converted into a karia- 
alphabet which is made up of two-place syllables containing one 
consonant and one vowel# ' 

At the next stage of development a slight change, appears in 
that consonants and vowels occur on the longer as well as on the 
shorter part of the slide* The plain sequences of the elides may 
show skips of two or three cells Instead of the normal step of one 
cell as measured on the cipher sequence. Within a regular route 
( Tumua ) of 42 (?) letters only two different types of skip • ; . 
appear, in each case with two to three simple and one to two dou- 
ble steps at definite intervals* Consequently this is a very 
feebly irregular skip system* Consequently the possibilities of 
solving the cipher text were hardly affected. The different daily 
keys can be derived from one another within a decade (10 day period? 
from the 1st to the 10th, 11th to 20th, 21st to 30th of the month) 

• • t ’ 

through a 2-part decade key, so that solution of one message within 
a decade is sufficient to permit reading all traffic of this decade. 
During a period of two years the decade keys for a half year could 
be derived from a common half year key and the two half year keys 
from an annual key* Later on, a common annual key could not be 
recognized# 

About 1942 a new difficulty appeared, inasmuch as all typical 
telegram beginnings and common words were replaced by 3-place code 
groups, some of which were. taken from the international Q- groups. 
Isomorphic parallel passages become less frequent and solution is 
consequently somewhat more laborious* 

From about 1943 on, the cipher text could no longer be solved. 
Outwardly the messages did not differ in any way from the earlier 
traffic so that it was natural to assume that the same machine was 
involved, but in a much Improved version although no proof of this 
could be obtained* 

33 


TOP SECRET 


Doc ID: 6592463 


TOP SECRET - 


Assuming that the> machine was based an the same principle, a 
study of the cipher test and particularly of the isomorphic passages 
allows the deduction that the hitherto feebly irregular skip system 
has been replaced by a very irregular skip system with short and 
long skip intervals (in case the plain text has not been enciphered 
according to some other system before being enciphered with the 
machine) 


2® The Hagelin Cipher Machines ® 

The Swedish Hagelin machines which are available in the open 
market have had a wider distribution, and a special model is used on 
a large scale by the American army® ~ . 

An older model of the Swedish Hagelin Company and a quite differ- 
ent although less secure model put out by the. French Hagelin Company 


cannot be treated here because these 9 models are not known to the 
authOFo Hi© fairly recent model of. 1939 reveals as essential cipher 
parts 6' variableipin wheels and the so-called basket (cage) on the 
bars of which are found a considerable number of lugs which can be 
set corresponding to the different wheels* The number of lugs runs 
Up to 27o With each revolution of the wheels and the associated 
revolution of the basket which takes place after the encipherment of 
each letter, those lugs become effective which encounter a : pin pro- 
jection on the corresponding wheel* If the pin projections on the 
wheels are represented by a plus and the absence of pin projections 
by a minus and the lugs are set, let us say, with respect 


to wheels I II IH .19 ¥ VI 

in each case a) 8 7 6 3 2 1 “27 

or b) • 22 1 1 1 i 1 .« 27 

or ■ °) 4 4 4‘ 4 4 7 63 27 

Then with the following pin patterns on the 6 wheels the following 

number of lugs will be effective: 
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Since the alphabet has 25 (26?) letters and the effective lugs indi- 
cate how many letters one is to count ahead in the alphabet in order 
to reach the cipher letter, any letter * according to the lug posi- 
tion - can become a cipher letter, as is the case with lug setting a» 
Examples b and o show that there are also very unfavorable lug settings 
The wheels of the Hagelin machine have a regular stepping, io®*, 
they move after the encipherment of an elements The total period of the 
one step machine is fairly large since the wheel lengths have no 
common factors and consequently the period of the machine is the pro- 
duct of the lengths of the six wheels 0 

Since what we have is a systematic polyalphabetio substitution 
( Spaltoncgsar ) with a known alphabet sequence, there is a possibility 
of solution corresponding to what we have learned in connection with 
oolyalphabetic substitution ( SpaltenoSsar ) as soon as at least two 

messages in the same key are found* 35 
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There ia a second possibility of solution if w© have continuous 
enciphered tests of a certain mlnlnam length, this minimum depending 
on the more or less favorable distribution of the lugs on the bars and 
ranging between 3,000 and 8,000 letters* 

If the entire cipher test is scored in six rectangles with column 
widths corresponding to the length 8 i.e*, the possible positions - 
of the six wheels, with 25 rows corresponding to the cipher elements 
a to s, then in the 25 rows of each rectangle the resulting high or 
low scores in the cells will reflect the pin pattern of the wheels con- 
corned in such fashion that in the one row the heavily scored cells 
will reflect the pins in effective position on the wheel while in 
another row this will be shown by the lightly scored cells* Of course 
this reflection of the pin pattern is not equally well impressed on 
• each row, nevertheless by evaluating all the rows of a rectangle 
simultaneously one can recognise with a high degree of probability 
the pin pattern of the wheel and also its initial position « All that 
remains unknown is whether the total result from the 25 rows of the 
rectangle is the direct or the inverted picture of the pin pattem 0 
Hence there are 26 ® 64 possibilities of setting up the pins on the 
wheel. 

The study of the 64 possible pin patterns in connection with the 
cipher test, taking into account the plain text frequency, afford s a 
possibility of determining the number of lugs associated with the in- 
dividual wheels, whereupon the cipher test can be deciphered with the 
nachine. 

Of course, two methods of solution are involved which are tied to 
assumptions which could easily be avoided by the cipher clerk so that 
these are really theoretical possibilities of solution which occur only 
where there has been carelessness in enciphering* 

So it happens even with this relatively good cipher machine, whose 
security is to be rated high, that the two remaining methods of solution 
both start with regularities inherent in the machine, namely the 
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columnar substitution alphabet (SpaltencSsar ) » which has for all 
columns Hie same sequence of letters simply with a different displace- 
ment* and the regular stepping of the six wheels® If the individual 
alphabets were to have a structure which differed from day to day at 
least and if the stepping of the wheels were irregular and random, 
then these two methods of solution would be ruled out® 

3o The Russian Multi-channel Radio Cipher Teleprinter 

During the last world war multi-channel radio cipher teleprinters 
were developed in Russia® In one ease a plain text printer and a 
cipher text printer are coupled synchronously* while in the second case 
a plain text printer and eight -cipher printers are synchronized so that 
all machines were sending in the radio alphabet at the same tempo 
(when the machine is not in use then - - - - etc®, was sent irres- 

pective of whether the individual machines were used for sending or 
hot}® The various plus and minus Impulses were so scrambled with one 
smother before transmission in both the 2-channel and the 9-channel 
machine that, when received, a technical unscrambling ‘was necessary 
before a cipher text capable Of expression in letters resulted for the 
several cipher channels® This cipher text could then be worked on by 
the cryptanalysts® 

For receiving the two-channel text a receiver was constructed 
which automatically undertook the unscrambling so that the machine pro- 
vided a plain text and a cipher text® 

Both texts indicated the pauses in transmission by - - — - - etc. 
The cipher tape has the peculiarity that in passing from the prelimi- 
nary call-up to the transmission pau8e,iathe/:RuSsianeletterr^ ^repre- 
sented in the radio alphabet by * > occurs seven times® On 

the other hand when passing from the transmission pause after the pre- 
liminary call-up,' during which pause the prearranged cipher key was 
set up on the machine, to the cipher text,* this seven-fold repetition 
of the same letter no longer appears nor did it then passing from the 
cipher traffic to the transmission pause 0 
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Now since it ms natural to assume that in this transition to and 

■ . , *;• i s * - 

from cipher testa the asms letter fl ® 4* t t f f likewise appeared 
seven times in each case but was no longer recognisable due to the 
encipherment, the first and last seydn cipher values of all cipher 

\ . i. • 

texts interrupted by transmission pauses were subjected to special 

3 

studio Since the machine, once the daily key had been set up, was 
used very frequently during the course of the day for sending cipher 
text with numerous pauses in transmission without any new daily key 
being set up, rather numerous fragments of a length of seven letters 

* . ‘ i . ‘ - 

were available at known intervals of greater or lesser lengths* 

The assumption, which at first was merely a vague one, became a 
certainty when once, after the sending and receiving machines had 

gotten out of step, an already used key was set up on the machine for 

/ * 

the second time and now not merely the first seven letters corresponded 
when passing to the first cipher text but in addition the change from 
cipher text to transmission pause of one cipher text and the change, from 
the transmission pause to the cipher text of the second cipher text 
coincided in the first four letters of the first transmissionpwith the 
last four letters of the second transmission and a count of the inter- 
vals of the two transmissions , counting each time from the beginning of 
the cipher text, showed a difference of three* . 

From this it could be concluded that the first seven and the last 
seven letters of each secret text cam© from enciphering the letter 

* * * i • 

n -■ -- * t seven times and h^nce these fragments of cipher text 

represented pure key text* The following study of these fraipents of 

¥ 

pure key text led to a recognition of the fact that the first impulses 
show the same repeated picture in the Chain of plus and minus impulses 
at an interval of 37, the second impulses at an interval of 39, the 
third impulses at an interval of 41, the fourth and fifth at an interval 
of 43 and 45 respectively (the intervals nay have been 35, 37, 39, 41, 

43 )o This showed the length of the five cipher wheels and their cam 
pattern according to the day’s setting* Each cam. crest caused the 
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inversion of the plain impulse into its opposite while a c am trough 
left a plain impulse unchanged* The wheels regularly moved one step k 
after each cipher letter® ■ 

With this the decipherment of the cipher tost had been accomplished* 
The reconstruction of the cam pattern of the wheels, which was set up 
new each day, was easily accomplished* 

It should have been an easy matter to reconstruct the machine, to 
intercept the day’s traffic on punched tap®, by means of the tape to 
determine the daily setting of the wheels, to set up the corresponding 
pattern in the machine and then have the punched tape deciphered by 
the machine* 

For the nine-channel cipher machine no receiving device was availa- 
ble which would unscramble the test* One piece of text which was un- 
scrambled manually was not of suffioientf^ength to permit any deductions 
as to the type of encipheraent* It was certain that the cipher part 
differed in construction from that of the two-channel machine* Sever- 
theless in all of the cipher texts and between texts such parallel 
passages and repetitions were found that it is highly' probable that a 
solution could have been reached had there been enough enciphered 
traffic* 

Since the solution of the two- channel cipher device was very easy 9 

due to a technical oversight, which resulted in the machines idling 

• * * 

while changing from transmission pause to plain text or cipher text, it 
was not necessary to make any study of the radio alphabet in connection 
with the Russian linguistic frequency curve in order in this way to find 
a method of solution, as was done in the case of the Siemens cipher 
teleprinter* 

4<> The English Cipher Machine * 

The author had no chance to become acquainted with the English ci- 
pher machine and saw no report on it*' Hence he can only say, based on 
hear-say, that it -Qas very similar to the Enigma in construction but 
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Instead of fear wheels like the Eaigna, has a set of five wheels of 
which the first does not change its position automatically when en- 
ciphering but is sot by hand before each new encipherment 0 The 
function of the first wheel would therefore correspond in a certain 
way to the plug board of the aray En%na and would produce an initial 
alphabet varying from message to message*. 

A machine constructed like the Enlgna but for enciphering ten 
digits instead of 26 letters is said to have been used by the Spanish 
Navy 5 it was never possible to get confirmation of this statement o 

If even with m anu a l systems any systematic character reduces the 
security of the system,, this danger oust be considered even greater 
in the case of cipher machines , since every machine encipherment is 
necessarily subject to certain regular characteristics and these reg- 
ularities must be assumed to be known because of the rather wide dis- 
tribution of the machines o The preceding studies of the various types 
of cipher machines have shown that the long period characteristic of 
almost all oipher machines does not guarantee 'security if the sub- 
periods, of which the total period is composed, permit enough regu- 
larities to be recognized so that a solution of cryptograms is possible 
Hence it is an Inevitable requirement for any cipher machine which 
makes claim to security that all machine parts which affect encipher- 

i . . , 

ment shall be capable of different settings and that in addition the 

% ‘ 

stepping of the machine shall be subject to marked irregularities 
which in their turn must also be influenced by different settings of 
the machine $ furthermore the columnar substitutions ( Spalt encgsar ) 
should change their structure from column to colixmn, in which connect- 
ion an extremely high number of different alphabets is less signifi- 
cant than a high variability and the absence of recognizable systematic 
features in their structure* Unless these prerequisites are given 
adequate consideration, the security of cipher machines will be less 
than that of good manual systems » 
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SECTIC8J C 

THE SIBOTFICANCB OP IMDICA^CR QROOPS WITH CIPHER MACHIHBS 

Whether it be because they are obtainable commercially 8 or because they 
are more widely distributed, or because their production cannot be kept 
secret as can that of a manual eastern? it is necessary for security reasons 

' . . * ■ :'■ » s' i 

to make the assumption that a cipher machine as such is known to the un- 
authorized cryptanalyst, hence it£ entire claim to security lies in the fact 
that the immediate internal and external setting of the machine or the day 
and massage keys are not knom and cannot be recognized from the cipher text* 
For this reason more attention most be given to the shaping of indicator 
groups for cipher machines than is required for manual systems* Xn general 
the daily key or the internal setting of the machine is arranged In advance 
eo that the indicator 9 e only function is to transmit the message key or the 
external machine setting* 

But, since in many cases a knowledge of the significance of the message 
key is enough to enable one to match up the day 1 s traffic in such fashion 
that it can be solved, it is necessary in any event that the message key or 
the indicator be transmitted only in enciphered form* la this connection 

the encipherment must be so handled that wen a knowledge of all the 

• ♦ / 

* . I,. * • 

indicators for a day will permit of no inferences as to their significance 
or as to the external machine setting* For this reason simple substitution 
tables cannot be regarded as adequate encipherment for indicator groups* 

In many cases people have resorted successfully to preventing the actual 
message key from appearing even in enciphered form* Instead of this only a 
machine setting is transmitted in enciphered farm, using which the encipher- 
ment of a pre-arranged text by the machine yields the massage keyj or a text 
is given which, when enciphered on the machine with a pre-arranged setting, 
yields the massage key* 

If cipher machines are used on a large seals one must also consider the 
danger which nay result if unreliable operating personnel utilises the choice of 
characters composing the indicator group to pass information regarding the 
internal setting of the machine, information which, when sent by radio, becomes 
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must be issued for the make-up of indicator groups or lists of indicator 
groups must be compiled which will limit or prevent misuse of these groups 
for other purposes,, 
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PART 17 

(aSMERAL (ffiSERVATKISS 

The point of this discussion of cryptographic systems was to shoe that 
the seemingly confusing multiplicity of systems can be reduced to very few 
simple basic concepts by a systematic arrangement . How small is actually the 
number of these basic concepts from which, in the long run, all cryptographic 
systems including the most modern hand or machine systems - can be derived - 
may be indicated by once more enumerating the concepts for basic systems 
which include among the substitution systems the simple substitution, digraphic 
substitution, poly alphabetic substitutions ( Springcfisaren and Spaltenc&sarfn ) 
as well as codes, and among the transposition systems the numerical key, 
grid and matrix transposition* With these all combined and reenciphered 
systems can be made up, if we add substitution tables and additive sequences 
as independent superenciphementso 

With these few concepts we can embrace the entire field of cryptography* 
The field becomes difficult only through the number of possibilities which 
result in practice through combinations or through the different internal 
relations of the various systems* 

The story is similar with the analysis of cryptographic systems on the 
basis of the cipher text available in a certain .amount of traffic * Her® 
again here are relatively few ways of making a count of the cipher text* An 
unknown cipher text can usually be dealt with by a chain' count, displacement 
count, group count, frequency count or by a position count fully enough for 
the evaluation of the frequencies of the individual elements and/or parallel 
passages according to frequency, length, interval and position to permit an 
analysis of the system* The most time consuming of these counts, in cases 
where the cipher text shows no parallel passages, may be a position count, 
which may have to extend over all possible column widths and where the cipher 
elements often have to be tom apart both by columns and also by rows, 
corresponding to the number of cipher elements, until structural regularities 
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can be recognized t&iah frequently consist in only slight deviations from 
an average determined by probability i, , 

Here the art of the cryptanalyst consists in correctly estimating 
the significance of the clues derived from the various counts, dues which 
are usually, few in number but may bd of considerable extent, and in correctly 

? ' . ‘ j '-l ■ , • 

judging them as a whole* ' ;“ : j 

Prom tiie analyses of the dryptoi^aphic systems given in the examples 
it is quite dear that the concept of the security of a cryptographic 
.syBt^ can ody be a relative oho, \ since it is very closely related to the 
amount of traffic enciphered with the System in question and available to 
the unauthorized cryptanalyst » Even the best cryptographic system possesses 
security against unauthorized decryption only within a certain amount of 
traffic, a limit which cannot be exceeded without endangering eeourity 0 
In checking the security of a cryptographic system it is, therefore, 
necessary to ascertain first what the minimum amount of traffic is which 
will just sake possible solution of the system « The answer can only be 
obtained with certainty by a thorou^ily experienced cryptanalyst who has 
a complete s ur v ey of all the possibilities available in the tecimical field 
for unauthorized decryption and who can estimate their Importance correctly * 
From this there fallows necessarily below this minimum a maximum of traffic 
which may be enciphered with the system in question without endangering Its 
security* 

3h determining this maximum, however, a factor of uncertainty must be 
included, the magnitude of whioh is determined by the following considerations: 
lo Tha r egulations governing the use of the system will not be followed 
exactly by the cipher personnel, as experience shows, as soon as 
unusual circumstances arise* 

2 e The greater the extent to which a system is used, the greater is the 
danger of possible loss or of compromise of part or all of the keys 
and other basic materials, due to seme other causes* 

.. *4 ' 
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3« Th© repetition of an erroneously enciphered text, the encipherment 
of a similar text in the sans system, the encipherment of the 
sans text in two different key settings or in two different systems, 
the subsequent publication of parts of the secret text, ©tc 0 etc? 
represent dangers whose extent cannot always be predicted definitely 
and varies with the type of system., 

Practical experience has shown that the factor of uncertainty, by which the 
previously ascertained maximum of traffic must be multiplied, is generally to 
be taken as at least one-half <, According to the clrcui&tances, a factor 
of uncertainty mounting to one-third or one-fourth may be recommended* In 
spite of all precantionary measures, a constant check on the observance of 
the rules la id down for a system and the amount of traffic to be enciphered 
in the system is very desirable because even the best cryptographic syst ems 
cannot be secure under all conditions when they are improperly usedo 
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